release notes: 2.33.3

[Backport 2.33-maintenance] fix: #15208

.github/workflows/backport.yml

@@ -0,0 +1,37 @@
+name: Backport
+on:
+  pull_request_target:
+    types: [closed, labeled]
+permissions:
+  contents: read
+jobs:
+  backport:
+    name: Backport Pull Request
+    permissions:
+      # for korthout/backport-action
+      contents: write
+      pull-requests: write
+    if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.CI_APP_ID }}
+          private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          # required to find all branches
+          fetch-depth: 0
+      - name: Create backport PRs
+        uses: korthout/backport-action@c656f5d5851037b2b38fb5db2691a03fa229e3b2 # v4.0.1
+        id: backport
+        with:
+          # Config README: https://github.com/korthout/backport-action#backport-action
+          github_token: ${{ steps.generate-token.outputs.token }}
+          github_workspace: ${{ github.workspace }}
+          auto_merge_enabled: true
+          pull_description: |-
+            Automatic backport to `${target_branch}`, triggered by a label in #${pull_number}.

.github/workflows/ci.yml

@@ -0,0 +1,267 @@
+name: "CI"
+
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches:
+      - master
+  workflow_dispatch:
+    inputs:
+      dogfood:
+        description: 'Use dogfood Nix build'
+        required: false
+        default: true
+        type: boolean
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: read-all
+
+jobs:
+  eval:
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+    - uses: ./.github/actions/install-nix-action
+      with:
+        dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+        extra_nix_config:
+          experimental-features = nix-command flakes
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        use_cache: false
+    - run: nix flake show --all-systems --json
+
+  pre-commit-checks:
+    name: pre-commit checks
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/install-nix-action
+        with:
+          dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+          extra_nix_config: experimental-features = nix-command flakes
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      - run: ./ci/gha/tests/pre-commit-checks
+
+  basic-checks:
+    name: aggregate basic checks
+    if: ${{ always() }}
+    runs-on: ubuntu-24.04
+    needs: [pre-commit-checks, eval]
+    steps:
+      - name: Exit with any errors
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+        run: |
+          exit 1
+
+  tests:
+    needs: basic-checks
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - scenario: on ubuntu
+            runs-on: ubuntu-24.04
+            os: linux
+            instrumented: false
+            primary: true
+            stdenv: stdenv
+          - scenario: on macos
+            runs-on: macos-14
+            os: darwin
+            instrumented: false
+            primary: true
+            stdenv: stdenv
+          - scenario: on ubuntu (with sanitizers / coverage)
+            runs-on: ubuntu-24.04
+            os: linux
+            instrumented: true
+            primary: false
+            stdenv: clangStdenv
+    name: tests ${{ matrix.scenario }}
+    runs-on: ${{ matrix.runs-on }}
+    timeout-minutes: 60
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+    - uses: ./.github/actions/install-nix-action
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+        # The sandbox would otherwise be disabled by default on Darwin
+        extra_nix_config: "sandbox = true"
+    # Since ubuntu 22.30, unprivileged usernamespaces are no longer allowed to map to the root user:
+    # https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
+    - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      if: matrix.os == 'linux'
+    - name: Run component tests
+      run: |
+        nix build --file ci/gha/tests/wrapper.nix componentTests -L \
+          --arg withInstrumentation ${{ matrix.instrumented }} \
+          --argstr stdenv "${{ matrix.stdenv }}"
+    - name: Run VM tests
+      run: |
+        nix build --file ci/gha/tests/wrapper.nix vmTests -L \
+          --arg withInstrumentation ${{ matrix.instrumented }} \
+          --argstr stdenv "${{ matrix.stdenv }}"
+      if: ${{ matrix.os == 'linux' }}
+    - name: Run flake checks and prepare the installer tarball
+      run: |
+        ci/gha/tests/build-checks
+        ci/gha/tests/prepare-installer-for-github-actions
+      if: ${{ matrix.primary }}
+    - name: Collect code coverage
+      run: |
+        nix build --file ci/gha/tests/wrapper.nix codeCoverage.coverageReports -L \
+          --arg withInstrumentation ${{ matrix.instrumented }} \
+          --argstr stdenv "${{ matrix.stdenv }}" \
+          --out-link coverage-reports
+        cat coverage-reports/index.txt >> $GITHUB_STEP_SUMMARY
+      if: ${{ matrix.instrumented }}
+    - name: Upload coverage reports
+      uses: actions/upload-artifact@v5
+      with:
+        name: coverage-reports
+        path: coverage-reports/
+      if: ${{ matrix.instrumented }}
+    - name: Upload installer tarball
+      uses: actions/upload-artifact@v5
+      with:
+        name: installer-${{matrix.os}}
+        path: out/*
+      if: ${{ matrix.primary }}
+
+  installer_test:
+    needs: [tests]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - scenario: on ubuntu
+            runs-on: ubuntu-24.04
+            os: linux
+            experimental-installer: false
+          - scenario: on macos
+            runs-on: macos-14
+            os: darwin
+            experimental-installer: false
+          - scenario: on ubuntu (experimental)
+            runs-on: ubuntu-24.04
+            os: linux
+            experimental-installer: true
+          - scenario: on macos (experimental)
+            runs-on: macos-14
+            os: darwin
+            experimental-installer: true
+    name: installer test ${{ matrix.scenario }}
+    runs-on: ${{ matrix.runs-on }}
+    steps:
+    - uses: actions/checkout@v6
+    - name: Download installer tarball
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+      with:
+        name: installer-${{matrix.os}}
+        path: out
+    - name: Looking up the installer tarball URL
+      id: installer-tarball-url
+      run: |
+        echo "installer-url=file://$GITHUB_WORKSPACE/out" >> "$GITHUB_OUTPUT"
+        TARBALL_PATH="$(find "$GITHUB_WORKSPACE/out" -name 'nix*.tar.xz' -print | head -n 1)"
+        echo "tarball-path=file://$TARBALL_PATH" >> "$GITHUB_OUTPUT"
+    - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31.8.4
+      if: ${{ !matrix.experimental-installer }}
+      with:
+        install_url: ${{ format('{0}/install', steps.installer-tarball-url.outputs.installer-url) }}
+        install_options: ${{ format('--tarball-url-prefix {0}', steps.installer-tarball-url.outputs.installer-url) }}
+    - uses: ./.github/actions/install-nix-action
+      if: ${{ matrix.experimental-installer }}
+      with:
+        dogfood: false
+        experimental-installer: true
+        tarball_url: ${{ steps.installer-tarball-url.outputs.tarball-path }}
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+    - run: sudo apt install fish zsh
+      if: matrix.os == 'linux'
+    - run: brew install fish
+      if: matrix.os == 'darwin'
+    - run: exec bash -c "nix-instantiate -E 'builtins.currentTime' --eval"
+    - run: exec sh -c "nix-instantiate -E 'builtins.currentTime' --eval"
+    - run: exec zsh -c "nix-instantiate -E 'builtins.currentTime' --eval"
+    - run: exec fish -c "nix-instantiate -E 'builtins.currentTime' --eval"
+    - run: exec bash -c "nix-channel --add https://releases.nixos.org/nixos/unstable/nixos-23.05pre466020.60c1d71f2ba nixpkgs"
+    - run: exec bash -c "nix-channel --update && nix-env -iA nixpkgs.hello && hello"
+
+  docker_push_image:
+    name: Push docker image to DockerHub and GHCR
+    needs: [flake_regressions, installer_test]
+    if: github.event_name == 'push' && github.ref_name == 'master'
+    uses: ./.github/workflows/docker-push.yml
+    with:
+      ref: ${{ github.sha }}
+      is_master: true
+    permissions:
+      contents: read
+      packages: write
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+
+  flake_regressions:
+    needs: tests
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout nix
+        uses: actions/checkout@v6
+      - name: Checkout flake-regressions
+        uses: actions/checkout@v6
+        with:
+          repository: NixOS/flake-regressions
+          path: flake-regressions
+      - name: Checkout flake-regressions-data
+        uses: actions/checkout@v6
+        with:
+          repository: NixOS/flake-regressions-data
+          path: flake-regressions/tests
+      - name: Download installer tarball
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: installer-linux
+          path: out
+      - name: Looking up the installer tarball URL
+        id: installer-tarball-url
+        run: |
+          echo "installer-url=file://$GITHUB_WORKSPACE/out" >> "$GITHUB_OUTPUT"
+      - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0
+        with:
+          install_url: ${{ format('{0}/install', steps.installer-tarball-url.outputs.installer-url) }}
+          install_options: ${{ format('--tarball-url-prefix {0}', steps.installer-tarball-url.outputs.installer-url) }}
+      - name: Run flake regressions tests
+        run: MAX_FLAKES=25 flake-regressions/eval-all.sh
+
+  profile_build:
+    needs: tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    if: >-
+      github.event_name == 'push' &&
+      github.ref_name == 'master'
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+    - uses: ./.github/actions/install-nix-action
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
+        extra_nix_config: |
+          experimental-features = flakes nix-command ca-derivations impure-derivations
+          max-jobs = 1
+    - run: |
+        nix build -L --file ./ci/gha/profile-build buildTimeReport --out-link build-time-report.md
+        cat build-time-report.md >> $GITHUB_STEP_SUMMARY

.github/workflows/docker-push.yml

@@ -0,0 +1,101 @@
+name: "Push Docker Image"
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Git ref to build the docker image from"
+        required: true
+        type: string
+      is_master:
+        description: "Whether run from master branch"
+        required: true
+        type: boolean
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: true
+      DOCKERHUB_TOKEN:
+        required: true
+
+permissions: {}
+
+jobs:
+  # Steps to test CI automation in your own fork.
+  # 1. Sign-up for https://hub.docker.com/
+  # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions)
+  # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork
+  check_secrets:
+    permissions:
+      contents: none
+    name: Check presence of secrets
+    runs-on: ubuntu-24.04
+    outputs:
+      docker: ${{ steps.secret.outputs.docker }}
+    steps:
+      - name: Check for DockerHub secrets
+        id: secret
+        env:
+          _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          echo "docker=${{ env._DOCKER_SECRETS != '' }}" >> $GITHUB_OUTPUT
+
+  push:
+    name: Push docker image to DockerHub and GHCR
+    needs: [check_secrets]
+    permissions:
+      contents: read
+      packages: write
+    if: needs.check_secrets.outputs.docker == 'true'
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        fetch-depth: 0
+        ref: ${{ inputs.ref }}
+    - uses: ./.github/actions/install-nix-action
+      with:
+        dogfood: false
+        extra_nix_config: |
+          experimental-features = flakes nix-command
+    - run: echo NIX_VERSION="$(nix eval .\#nix.version | tr -d \")" >> $GITHUB_ENV
+    - run: nix build .#dockerImage -L
+    - run: docker load -i ./result/image.tar.gz
+    # We'll deploy the newly built image to both Docker Hub and Github Container Registry.
+    #
+    # Push to Docker Hub first
+    - name: Login to Docker Hub
+      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+    - name: Push to Docker Hub
+      env:
+        IS_MASTER: ${{ inputs.is_master }}
+        DOCKERHUB_REPO: ${{ secrets.DOCKERHUB_USERNAME }}/nix
+      run: |
+        docker tag nix:$NIX_VERSION $DOCKERHUB_REPO:$NIX_VERSION
+        docker push $DOCKERHUB_REPO:$NIX_VERSION
+        if [ "$IS_MASTER" = "true" ]; then
+          docker tag nix:$NIX_VERSION $DOCKERHUB_REPO:master
+          docker push $DOCKERHUB_REPO:master
+        fi
+    # Push to GitHub Container Registry as well
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Push to GHCR
+      env:
+        IS_MASTER: ${{ inputs.is_master }}
+      run: |
+        IMAGE_ID=ghcr.io/${{ github.repository_owner }}/nix
+        IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+
+        docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION
+        docker push $IMAGE_ID:$NIX_VERSION
+        if [ "$IS_MASTER" = "true" ]; then
+          docker tag nix:$NIX_VERSION $IMAGE_ID:master
+          docker push $IMAGE_ID:master
+        fi

.github/workflows/labels.yml

@@ -0,0 +1,24 @@
+name: "Label PR"
+
+on:
+  pull_request_target:
+    types: [edited, opened, synchronize, reopened]
+
+# WARNING:
+# When extending this action, be aware that $GITHUB_TOKEN allows some write
+# access to the GitHub API. This means that it should not evaluate user input in
+# a way that allows code injection.
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  labels:
+    runs-on: ubuntu-24.04
+    if: github.repository_owner == 'NixOS'
+    steps:
+    - uses: actions/labeler@v6
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        sync-labels: false

.github/workflows/upload-release.yml

@@ -0,0 +1,69 @@
+name: Upload Release
+on:
+  workflow_dispatch:
+    inputs:
+      eval_id:
+        description: "Hydra evaluation ID"
+        required: true
+        type: number
+      is_latest:
+        description: "Mark as latest release"
+        required: false
+        type: boolean
+        default: false
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+jobs:
+  release:
+    runs-on: ubuntu-24.04
+    environment: releases
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: ./.github/actions/install-nix-action
+        with:
+          dogfood: false # Use stable version
+          use_cache: false # Don't want any cache injection shenanigans
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+      - name: Set NIX_PATH from flake input
+        run: |
+          NIXPKGS_PATH=$(nix build --inputs-from .# nixpkgs#path --print-out-paths --no-link)
+          # Shebangs with perl have issues. Pin nixpkgs this way. nix shell should maybe
+          # get the same uberhack that nix-shell has to support it.
+          echo "NIX_PATH=nixpkgs=$NIXPKGS_PATH" >> "$GITHUB_ENV"
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
+        with:
+          role-to-assume: "arn:aws:iam::080433136561:role/nix-release"
+          role-session-name: nix-release-oidc-${{ github.run_id }}
+          aws-region: eu-west-1
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upload release
+        run: |
+          ./maintainers/upload-release.pl \
+            ${{ inputs.eval_id }} \
+            --skip-git
+        env:
+          IS_LATEST: ${{ inputs.is_latest && '1' || '' }}
+      - name: Push to GHCR
+        run: |
+          DOCKER_OWNER="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[A-Z]' '[a-z]')/nix"
+          ./maintainers/upload-release.pl \
+            ${{ inputs.eval_id }} \
+            --skip-git \
+            --skip-s3 \
+            --docker-owner "$DOCKER_OWNER"
+        env:
+          IS_LATEST: ${{ inputs.is_latest && '1' || '' }}

.gitignore

@@ -1,7 +1,5 @@
 # Default meson build dir
 /build
-# Meson creates this file too
-src/.wraplock
 
 # /tests/functional/
 /tests/functional/common/subst-vars.sh
@@ -16,10 +14,6 @@ src/.wraplock
 /tests/functional/lang/*.err
 /tests/functional/lang/*.ast
 
-# /tests/functional/cli-characterisation/
-/tests/functional/cli-characterisation/*.out
-/tests/functional/cli-characterisation/*.err
-
 /outputs
 
 *~

.version

@@ -1 +1 @@
-2.35.0
+2.33.3

ci/gha/tests/windows.nix

@@ -1,30 +0,0 @@
-{
-  nixFlake ? builtins.getFlake ("git+file://" + toString ../../..),
-  system ? builtins.currentSystem,
-  pkgs ? nixFlake.inputs.nixpkgs.legacyPackages.${system},
-}:
-
-let
-  packages = nixFlake.packages.${system};
-
-  fixOutput =
-    test:
-    test.overrideAttrs (prev: {
-      nativeBuildInputs = prev.nativeBuildInputs or [ ] ++ [ pkgs.colorized-logs ];
-      env.GTEST_COLOR = "no";
-      # Wine's console emulation wraps every character in ANSI cursor
-      # hide/show sequences, making logs unreadable in GitHub Actions.
-      buildCommand = ''
-        set -o pipefail
-        {
-          ${prev.buildCommand}
-        } 2>&1 | ansi2txt
-      '';
-    });
-in
-
-{
-  unitTests = {
-    "nix-util-tests" = fixOutput packages."nix-util-tests-x86_64-w64-mingw32".passthru.tests.run;
-  };
-}

doc/manual/meson.build

@@ -26,6 +26,7 @@ bash = find_program('bash', native : true)
 # HTML manual dependencies (conditional)
 if get_option('html-manual')
   mdbook = find_program('mdbook', native : true)
+  rsync = find_program('rsync', required : true, native : true)
 endif
 
 pymod = import('python')
@@ -125,12 +126,7 @@ if get_option('html-manual')
           @0@ @INPUT0@ @CURRENT_SOURCE_DIR@ > @DEPFILE@
           @0@ @INPUT1@ summary @2@ < @CURRENT_SOURCE_DIR@/source/SUMMARY.md.in > @2@/source/SUMMARY.md
           sed -e 's|@version@|@3@|g' < @INPUT2@ > @2@/book.toml
-          # Copy source to build directory, excluding the build directory itself
-          # (which is present when built as an individual component).
-          # Use tar with --dereference to copy symlink targets (e.g., JSON examples from tests).
-          (cd @CURRENT_SOURCE_DIR@ && find . -mindepth 1 -maxdepth 1 ! -name build | tar -c --dereference -T - -f -) | (cd @2@ && tar -xf -)
-          chmod -R u+w @2@
-          find @2@ -name '*.drv' -delete
+          @4@ -r -L --exclude='*.drv' --include='*.md' @CURRENT_SOURCE_DIR@/ @2@/
           (cd @2@; RUST_LOG=warn @1@ build -d @2@ 3>&2 2>&1 1>&3) | { grep -Fv "because fragment resolution isn't implemented" || :; } 3>&2 2>&1 1>&3
           rm -rf @2@/manual
           mv @2@/html @2@/manual
@@ -142,6 +138,7 @@ if get_option('html-manual')
         mdbook.full_path(),
         meson.current_build_dir(),
         meson.project_version(),
+        rsync.full_path(),
       ),
     ],
     input : [

doc/manual/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   callPackage,
   mkMesonDerivation,
   runCommand,
@@ -11,6 +10,7 @@
   mdbook,
   jq,
   python3,
+  rsync,
   nix-cli,
   changelog-d,
   json-schema-for-humans,
@@ -54,8 +54,6 @@ mkMesonDerivation (finalAttrs: {
         ../../src/libstore-tests/data/nar-info
         ../../src/libstore-tests/data/build-result
         ../../src/libstore-tests/data/dummy-store
-        # For derivation examples referenced by symlinks in doc/manual/source/protocols/json/schema/
-        ../../tests/functional/derivation
         # Too many different types of files to filter for now
         ../../doc/manual
         ./.
@@ -92,13 +90,13 @@ mkMesonDerivation (finalAttrs: {
   ]
   ++ lib.optionals buildHtmlManual [
     mdbook
+    rsync
     json-schema-for-humans
   ]
-  ++ lib.optionals (!officialRelease && buildHtmlManual && !stdenv.hostPlatform.isi686) [
+  ++ lib.optionals (!officialRelease && buildHtmlManual) [
     # When not an official release, we likely have changelog entries that have
     # yet to be rendered.
     # When released, these are rendered into a committed file to save a dependency.
-    # Broken on i686.
     changelog-d
   ];
 

doc/manual/rl-next/beta-installer

@@ -1,29 +0,0 @@
----
-synopsis: "Rust nix-installer in beta"
-prs: []
----
-
-The Rust-based rewrite of the Nix installer is now in beta.
-We'd love help testing it out!
-
-To test out the new installer, run:
-```
-curl -sSfL https://artifacts.nixos.org/nix-installer | sh -s -- install
-```
-
-This installer can be run even when you have an existing, script-based Nix installation without any adjustments.
-
-This new installer also comes with the ability to uninstall your Nix installation; run:
-```
-/nix/nix-installer uninstall
-```
-
-This will get rid of your entire Nix installation (even if you installed over an existing, script-based installation).
-
-This installer is a modified version of the [Determinate Nix Installer](https://github.com/DeterminateSystems/nix-installer) by Determinate Systems.
-Thanks to Determinate Systems for all the investment they've put into the installer.
-
-Source for the installer is in https://github.com/NixOS/nix-installer.
-Report any issues in that repo.
-
-For CI usage, a GitHub Action to install Nix using this installer is available at https://github.com/NixOS/nix-installer-action.

doc/manual/rl-next/build-trace-rework.md

@@ -1,81 +0,0 @@
----
-synopsis: "Content-addressed derivations: realisations keyed by store path instead of hash modulo"
-issues: [11897]
-prs: [12464]
----
-
-The experimental content-addressed (CA) derivation feature has undergone a significant change to how build traces (formerly called "realisations") are identified. This affects the **binary cache protocol** and the **wire protocols**.
-
-### What changed
-
-Previously, a build trace entry (realisation) was keyed by the **hash modulo** of the derivation.
-A SHA-256 hash computed via the complex "derivation hash modulo" algorithm.
-This required implementations to understand ATerm serialisation and the full derivation hashing scheme just to look up or store build results.
-
-Now, build trace entries are keyed by the **regular derivation store path** plus the output name. For example, instead of:
-
-```
-sha256:ba7816bf8f01...!out
-```
-
-The key is now:
-
-```
-/nix/store/abc...-foo.drv^out
-```
-
-This is simpler, more intuitive, and means that third-party tools implementing CA derivation support (e.g., Hydra)
-no longer need to implement the derivation hash modulo algorithm.
-
-### Binary cache protocol
-
-- The directory for build traces moved from `realisations/` to `build-trace-v2/`.
-- File paths changed from `realisations/<hash>!<output>.doi` to `build-trace-v2/<drvName>/<outputName>.doi`.
-- The JSON format of build trace entries is now split into `key` and `value` objects:
-  ```json
-  {
-    "key": {
-      "drvPath": "abc...-foo.drv",
-      "outputName": "out"
-    },
-    "value": {
-      "outPath": "xyz...-foo",
-      "signatures": [{ "keyName": "cache.example.com-1", "sig": "..." }]
-    }
-  }
-  ```
-  Previously, these were flat objects with a string `id` field like `"sha256:...!out"`.
-- The deprecated `dependentRealisations` field has been removed.
-
-Existing binary caches will need to be re-populated with the new format for CA derivation build traces.
-Old build traces at the previous URLs are simply abandoned.
-Non-CA builds are unaffected.
-
-### Wire protocols
-
-- **Worker protocol**:
-  A new feature flag `realisation-with-path-not-hash` is negotiated during the handshake.
-  Clients and daemons that both support this feature use the new binary serialisation for `DrvOutput`, `UnkeyedRealisation`, and related types.
-  Fallback to older protocol versions gracefully degrades (realisations are unavailable).
-- **Serve protocol**:
-  Bumped from 2.7 to 2.8 with native serialisers for the new types.
-  Fallback to older protocol versions gracefully degrades in the same way.
-
-Stable code paths do use the realization fields (`BuildResult::Success::builtOutputs`), but only the output name and outpath parts of that.
-For older protocols, we can fake enough of the realisation format to provide those two parts forthat map, which keeps operations like `--print-output-paths` working.
-
-### Structured signatures
-
-[Signatures](@docroot@/protocols/json/signature.md) in JSON formats are now represented as structured objects with `keyName` and `sig` fields, rather than colon-separated strings.
-`nix path-info --json --json-format 3` opts into the new version for this command.
-JSON parsing accepts both the old string format and new structured format for backwards compatibility.
-
-### Impact
-
-- **Non-CA derivation users**: No impact. This only affects the experimental `ca-derivations` feature.
-- **Binary cache operators**:
-  Binary caches serving CA derivation build traces will need to be repopulated.
-  Existing NARs and narinfo files are unaffected.
-- **Tool authors**:
-  Implementations interfacing with the CA derivations protocol are simplified.
-  The derivation hash modulo algorithm is no longer required to form build trace keys.

doc/manual/rl-next/fix-primop-eval-state.md

@@ -1,10 +0,0 @@
----
-synopsis: "C API: Fix `EvalState` pointer passed to primop callbacks"
-prs: [15300, 15383]
----
-
-The `EvalState *` passed to C API primop callbacks was incorrectly pointing to
-the internal `nix::EvalState` rather than the C API wrapper struct. This caused
-a segfault when the callback used the pointer with C API functions such as
-`nix_alloc_value()`. The same issue affected `printValueAsJSON` and
-`printValueAsXML` callbacks on external values.

doc/manual/rl-next/github-fetcher-param-validation.md

@@ -1,7 +0,0 @@
----
-synopsis: GitHub fetcher now validates URL parameters
-prs: [15331]
-issues: [15304]
----
-
-The `github:` fetcher now validates URL parameters, and will error if an invalid parameter like `tag` is provided.

doc/manual/source/SUMMARY.md.in

@@ -125,7 +125,6 @@
     - [Hash](protocols/json/hash.md)
     - [Content Address](protocols/json/content-address.md)
     - [Store Path](protocols/json/store-path.md)
-    - [Signature](protocols/json/signature.md)
     - [Store Object Info](protocols/json/store-object-info.md)
     - [Derivation](protocols/json/derivation/index.md)
       - [Derivation Options](protocols/json/derivation/options.md)
@@ -136,9 +135,7 @@
   - [Serving Tarball Flakes](protocols/tarball-fetcher.md)
   - [Store Path Specification](protocols/store-path.md)
   - [Nix Archive (NAR) Format](protocols/nix-archive/index.md)
-  - [Nix Cache Info Format](protocols/nix-cache-info.md)
   - [Derivation "ATerm" file format](protocols/derivation-aterm.md)
-  - [Nix32 Encoding](protocols/nix32.md)
 - [C API](c-api.md)
 - [Glossary](glossary.md)
 - [Development](development/index.md)
@@ -154,7 +151,6 @@
   - [Contributing](development/contributing.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
-  - [Release 2.34 (2026-02-27)](release-notes/rl-2.34.md)
   - [Release 2.33 (2025-12-09)](release-notes/rl-2.33.md)
   - [Release 2.32 (2025-10-06)](release-notes/rl-2.32.md)
   - [Release 2.31 (2025-08-21)](release-notes/rl-2.31.md)

doc/manual/source/advanced-topics/eval-profiler.md

@@ -27,7 +27,7 @@ site](https://en.wikipedia.org/wiki/Call_site) position and the name of the
 function being called (when available). For example:
 
 ```
-/nix/store/2q71fdvr4h33g9832hiriwnf20fn630l-source/pkgs/top-level/default.nix:167:5:primop import
+/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5:primop import
 ```
 
-Here `import` primop is called at `/nix/store/2q71fdvr4h33g9832hiriwnf20fn630l-source/pkgs/top-level/default.nix:167:5`.
+Here `import` primop is called at `/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5`.

doc/manual/source/command-ref/env-common.md

@@ -57,6 +57,11 @@ Most Nix commands interpret the following environment variables:
 
   Overrides the location of the Nix store (default `prefix/store`).
 
+- <span id="env-NIX_DATA_DIR">[`NIX_DATA_DIR`](#env-NIX_DATA_DIR)</span>
+
+  Overrides the location of the Nix static data directory (default
+  `prefix/share`).
+
 - <span id="env-NIX_LOG_DIR">[`NIX_LOG_DIR`](#env-NIX_LOG_DIR)</span>
 
   Overrides the location of the Nix log directory (default

doc/manual/source/command-ref/files/default-nix-expression.md

@@ -39,11 +39,11 @@ This makes all subscribed channels available as attributes in the default expres
 A symlink that ensures that [`nix-env`] can find the current user's [channels]:
 
 - `~/.nix-defexpr/channels`
-- `$XDG_STATE_HOME/nix/defexpr/channels` if [`use-xdg-base-directories`] is set to `true`.
+- `$XDG_STATE_HOME/defexpr/channels` if [`use-xdg-base-directories`] is set to `true`.
 
 This symlink points to:
 
-- `$XDG_STATE_HOME/nix/profiles/channels` for regular users
+- `$XDG_STATE_HOME/profiles/channels` for regular users
 - `$NIX_STATE_DIR/profiles/per-user/root/channels` for `root`
 
 In a multi-user installation, you may also have `~/.nix-defexpr/channels_root`, which links to the channels of the root user.

doc/manual/source/command-ref/files/manifest.nix.md

@@ -114,9 +114,9 @@ Here is an example of how this file might look like after installing `hello` fro
   };
   name = "hello-2.12.1";
   out = {
-    outPath = "/nix/store/src1vzij2z0slnakrsbpqpk20389z0k6-hello-2.12.1";
+    outPath = "/nix/store/260q5867crm1xjs4khgqpl6vr9kywql1-hello-2.12.1";
   };
-  outPath = "/nix/store/src1vzij2z0slnakrsbpqpk20389z0k6-hello-2.12.1";
+  outPath = "/nix/store/260q5867crm1xjs4khgqpl6vr9kywql1-hello-2.12.1";
   outputs = [ "out" ];
   system = "x86_64-linux";
   type = "derivation";

doc/manual/source/command-ref/files/profiles.md

@@ -37,13 +37,13 @@ dr-xr-xr-x 4 root root 4096 Jan  1  1970 share
 
 /home/eelco/.local/state/nix/profiles/profile-7-link/bin:
 total 20
-lrwxrwxrwx 5 root root 79 Jan  1  1970 chromium -> /nix/store/cyxny9d1zjb9l9103fr6j6kavp3bqjxf-chromium-86.0.4240.111/bin/chromium
+lrwxrwxrwx 5 root root 79 Jan  1  1970 chromium -> /nix/store/ijm5k0zqisvkdwjkc77mb9qzb35xfi4m-chromium-86.0.4240.111/bin/chromium
 lrwxrwxrwx 7 root root 87 Jan  1  1970 spotify -> /nix/store/w9182874m1bl56smps3m5zjj36jhp3rn-spotify-1.1.26.501.gbe11e53b-15/bin/spotify
 lrwxrwxrwx 3 root root 79 Jan  1  1970 zoom-us -> /nix/store/wbhg2ga8f3h87s9h5k0slxk0m81m4cxl-zoom-us-5.3.469451.0927/bin/zoom-us
 
 /home/eelco/.local/state/nix/profiles/profile-7-link/share/applications:
 total 12
-lrwxrwxrwx 4 root root 120 Jan  1  1970 chromium-browser.desktop -> /nix/store/sqzyx2l85i6j2a77pnyvglh3bvzwmjjp-chromium-unwrapped-86.0.4240.111/share/applications/chromium-browser.desktop
+lrwxrwxrwx 4 root root 120 Jan  1  1970 chromium-browser.desktop -> /nix/store/4cf803y4vzfm3gyk3vzhzb2327v0kl8a-chromium-unwrapped-86.0.4240.111/share/applications/chromium-browser.desktop
 lrwxrwxrwx 7 root root 110 Jan  1  1970 spotify.desktop -> /nix/store/w9182874m1bl56smps3m5zjj36jhp3rn-spotify-1.1.26.501.gbe11e53b-15/share/applications/spotify.desktop
 lrwxrwxrwx 3 root root 107 Jan  1  1970 us.zoom.Zoom.desktop -> /nix/store/wbhg2ga8f3h87s9h5k0slxk0m81m4cxl-zoom-us-5.3.469451.0927/share/applications/us.zoom.Zoom.desktop
 

doc/manual/source/command-ref/nix-copy-closure.md

@@ -72,11 +72,11 @@ When using public key authentication, you can avoid typing the passphrase with `
 > $ storePath="$(nix-build '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable -A hello --no-out-link)"
 > $ nix-copy-closure --to alice@itchy.example.org "$storePath"
 > copying 5 paths...
-> copying path '/nix/store/h6q8sqsqfbd3252f9gixqn3z282wds7m-xgcc-13.2.0-libgcc' to 'ssh://alice@itchy.example.org'...
-> copying path '/nix/store/imnwvn96lw355giswsk36hx105j4wnpj-libunistring-1.1' to 'ssh://alice@itchy.example.org'...
-> copying path '/nix/store/85301indj7scg34spnfczkz72jgv8wa9-libidn2-2.3.7' to 'ssh://alice@itchy.example.org'...
-> copying path '/nix/store/ypwfsaljwhzw9iffiysxmxnhjj8v7np0-glibc-2.39-31' to 'ssh://alice@itchy.example.org'...
-> copying path '/nix/store/0dklv59zppdsqdvgf0qdvjgzcs5wbwxa-hello-2.12.1' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/nrwkk6ak3rgkrxbqhsscb01jpzmslf2r-xgcc-13.2.0-libgcc' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/gm61h1y42pqyl6178g90x8zm22n6pyy5-libunistring-1.1' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/ddfzjdykw67s20c35i7a6624by3iz5jv-libidn2-2.3.7' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/apab5i73dqa09wx0q27b6fbhd1r18ihl-glibc-2.39-31' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/g1n2vryg06amvcc1avb2mcq36faly0mh-hello-2.12.1' to 'ssh://alice@itchy.example.org'...
 > ```
 
 > **Example**

doc/manual/source/command-ref/nix-env/install.md

@@ -204,7 +204,7 @@ To install a specific [store derivation] (typically created by
 `nix-instantiate`):
 
 ```console
-$ nix-env --install /nix/store/8la6y31fmm6i4wfmby6avly1wf718xnj-gcc-3.4.3.drv
+$ nix-env --install /nix/store/fibjb1bfbpm5mrsxc4mh2d8n37sxh91i-gcc-3.4.3.drv
 ```
 
 To install a specific output path:
@@ -232,7 +232,7 @@ $ nix-env --file '<nixpkgs>' --install --attr hello --dry-run
 (dry run; not doing anything)
 installing ‘hello-2.10’
 this path will be fetched (0.04 MiB download, 0.19 MiB unpacked):
-  /nix/store/ikwkxz4wwlp2g1428n7dy729cg1d9hin-hello-2.10
+  /nix/store/wkhdf9jinag5750mqlax6z2zbwhqb76n-hello-2.10
   ...
 ```
 

doc/manual/source/command-ref/nix-prefetch-url.md

@@ -76,7 +76,7 @@ $ nix-prefetch-url ftp://ftp.gnu.org/pub/gnu/hello/hello-2.10.tar.gz
 ```console
 $ nix-prefetch-url --print-path mirror://gnu/hello/hello-2.10.tar.gz
 0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i
-/nix/store/8alrpdaasjd1x6g1fczchmzbpqm936a3-hello-2.10.tar.gz
+/nix/store/3x7dwzq014bblazs7kq20p9hyzz0qh8g-hello-2.10.tar.gz
 ```
 
 ```console

doc/manual/source/command-ref/nix-store/add-fixed.md

@@ -34,6 +34,6 @@ This operation has the following options:
 
 ```console
 $ nix-store --add-fixed sha256 ./hello-2.10.tar.gz
-/nix/store/8alrpdaasjd1x6g1fczchmzbpqm936a3-hello-2.10.tar.gz
+/nix/store/3x7dwzq014bblazs7kq20p9hyzz0qh8g-hello-2.10.tar.gz
 ```
 

doc/manual/source/command-ref/nix-store/delete.md

@@ -27,7 +27,7 @@ paths in the store that refer to it (i.e., depend on it).
 # Example
 
 ```console
-$ nix-store --delete /nix/store/gjak3al7lj61x4gj6rln4f5pc5v0f67n-mesa-6.4
+$ nix-store --delete /nix/store/zq0h41l75vlb4z45kzgjjmsjxvcv1qk7-mesa-6.4
 0 bytes freed (0.00 MiB)
-error: cannot delete path `/nix/store/gjak3al7lj61x4gj6rln4f5pc5v0f67n-mesa-6.4' since it is still alive
+error: cannot delete path `/nix/store/zq0h41l75vlb4z45kzgjjmsjxvcv1qk7-mesa-6.4' since it is still alive
 ```

doc/manual/source/command-ref/nix-store/query.md

@@ -184,9 +184,9 @@ Print the build-time dependencies of `svn`:
 
 ```console
 $ nix-store --query --requisites $(nix-store --query --deriver $(which svn))
-/nix/store/y6qa66l9h0pw161crnlk6y16rdrcljx4-grep-2.5.1.tar.bz2.drv
-/nix/store/z716h753s97jhnzvfank2srqbljswpgm-gcc-wrapper.sh
-/nix/store/f39x0q73rjdyvzm93y9wrkfr6x39lb7f-glibc-2.3.4.drv
+/nix/store/02iizgn86m42q905rddvg4ja975bk2i4-grep-2.5.1.tar.bz2.drv
+/nix/store/07a2bzxmzwz5hp58nf03pahrv2ygwgs3-gcc-wrapper.sh
+/nix/store/0ma7c9wsbaxahwwl04gbw3fcd806ski4-glibc-2.3.4.drv
 ... lots of other paths ...
 ```
 
@@ -199,10 +199,10 @@ Show the build-time dependencies as a tree:
 ```console
 $ nix-store --query --tree $(nix-store --query --deriver $(which svn))
 /nix/store/7i5082kfb6yjbqdbiwdhhza0am2xvh6c-subversion-1.1.4.drv
-+---/nix/store/vxnmkc8l8d2ijjha4xwhkfgx9vvc3q4c-builder.sh
-+---/nix/store/rn9776dy82n5qrgz7xbcl1iw4vfkcrkk-bash-3.0.drv
-|   +---/nix/store/x9j20hz6bln1crzn55qifk0bbsm8v5ac-bash
-|   +---/nix/store/ajnn1mcm45wjvn0rlc22gvx2cwhjnazx-builder.sh
++---/nix/store/d8afh10z72n8l1cr5w42366abiblgn54-builder.sh
++---/nix/store/fmzxmpjx2lh849ph0l36snfj9zdibw67-bash-3.0.drv
+|   +---/nix/store/570hmhmx3v57605cqg9yfvvyh0nnb8k8-bash
+|   +---/nix/store/p3srsbd8dx44v2pg6nbnszab5mcwx03v-builder.sh
 ...
 ```
 

doc/manual/source/command-ref/nix-store/realise.md

@@ -76,7 +76,7 @@ This operation is typically used to build [store derivation]s produced by
 
 ```console
 $ nix-store --realise $(nix-instantiate ./test.nix)
-/nix/store/6gwmy5jcnwdlz6aqqhksz863f1l8xc2w-aterm-2.3.1
+/nix/store/31axcgrlbfsxzmfff1gyj1bf62hvkby2-aterm-2.3.1
 ```
 
 This is essentially what [`nix-build`](@docroot@/command-ref/nix-build.md) does.

doc/manual/source/development/building.md

@@ -3,10 +3,6 @@
 This section provides some notes on how to start hacking on Nix.
 To get the latest version of Nix from GitHub:
 
-> **Note**
->
-> When checking out the repo on Windows, make sure you have the git setting `core.symlinks` enabled, before cloning, as there are symlinks in the repo.
-
 ```console
 $ git clone https://github.com/NixOS/nix.git
 $ cd nix

doc/manual/source/development/debugging.md

@@ -6,7 +6,14 @@ Additionally, see [Testing Nix](./testing.md) for further instructions on how to
 
 ## Building Nix with Debug Symbols
 
-In the development shell, `mesonBuildType` is set automatically to `debugoptimized`. This builds Nix with debug symbols, which are essential for effective debugging.
+In the development shell, set the `mesonBuildType` environment variable to `debug` before configuring the build:
+
+```console
+[nix-shell]$ export mesonBuildType=debugoptimized
+```
+
+Then, proceed to build Nix as described in [Building Nix](./building.md).
+This will build Nix with debug symbols, which are essential for effective debugging.
 
 It is also possible to build without optimization for faster build:
 

doc/manual/source/glossary.md

@@ -39,7 +39,7 @@
   This sandbox by default only allows reading from store objects specified as inputs, and only allows writing to designated [outputs][output] to be [captured as store objects](@docroot@/store/building.md#processing-outputs).
 
   A derivation is typically specified as a [derivation expression] in the [Nix language], and [instantiated][instantiate] to a [store derivation].
-  There are multiple ways of obtaining store objects from store derivations, collectively called [realisation][realise].
+  There are multiple ways of obtaining store objects from store derivatons, collectively called [realisation][realise].
 
   [derivation]: #gloss-derivation
 
@@ -136,7 +136,7 @@
 
   > **Example**
   >
-  > `/nix/store/jf6gn2dzna4nmsfbdxsd7kwhsk6gnnlr-git-2.38.1`
+  > `/nix/store/a040m110amc4h71lds2jmr8qrkj2jhxd-git-2.38.1`
 
   See [Store Path](@docroot@/store/store-path.md) for details.
 

doc/manual/source/installation/building-source.md

@@ -6,23 +6,14 @@ It is broken up into multiple Meson packages, which are optionally combined in a
 There are no mandatory extra steps to the building process:
 generic Meson installation instructions like [this](https://mesonbuild.com/Quick-guide.html#using-meson-as-a-distro-packager) should work.
 
-```bash
-git clone https://github.com/NixOS/nix.git
-cd nix
-meson setup build
-cd build
-ninja
-(sudo) ninja install
-```
-
-The installation path can be specified by passing `-Dprefix=prefix`
-to `meson setup build`. The default installation directory is `/usr/local`. You
+The installation path can be specified by passing the `-Dprefix=prefix`
+to `configure`. The default installation directory is `/usr/local`. You
 can change this to any location you like. You must have write permission
 to the *prefix* path.
 
 Nix keeps its *store* (the place where packages are stored) in
 `/nix/store` by default. This can be changed using
-`-Dlibstore:store-dir=path`.
+`-Dstore-dir=path`.
 
 > **Warning**
 >

doc/manual/source/installation/uninstall.md

@@ -16,29 +16,30 @@ If you are on Linux with systemd:
    sudo systemctl daemon-reload
    ```
 
-2. Remove files created by Nix:
+Remove files created by Nix:
 
-   ```console
-   sudo rm -rf /etc/nix /etc/profile.d/nix.sh /etc/tmpfiles.d/nix-daemon.conf /nix ~/.local/share/nix ~/.local/state/nix ~/.cache/nix ~/.nix-defexpr ~/.nix-profile ~/.nix-channels ~root/.nix-channels ~root/.nix-defexpr ~root/.nix-profile ~root/.cache/nix
-   ```
+```console
+sudo rm -rf /etc/nix /etc/profile.d/nix.sh /etc/tmpfiles.d/nix-daemon.conf /nix ~root/.nix-channels ~root/.nix-defexpr ~root/.nix-profile ~root/.cache/nix
+```
 
-3. Remove build users and their group:
+Remove build users and their group:
 
-   ```console
-   for i in $(seq 1 32); do
-     sudo userdel nixbld$i
-   done
-   sudo groupdel nixbld
-   ```
+```console
+for i in $(seq 1 32); do
+  sudo userdel nixbld$i
+done
+sudo groupdel nixbld
+```
 
-4. There may also be references to Nix in
-   - `/etc/bash.bashrc`
-   - `/etc/bashrc`
-   - `/etc/profile`
-   - `/etc/zsh/zshrc`
-   - `/etc/zshrc`
+There may also be references to Nix in
 
-   which you may remove.
+- `/etc/bash.bashrc`
+- `/etc/bashrc`
+- `/etc/profile`
+- `/etc/zsh/zshrc`
+- `/etc/zshrc`
+
+which you may remove.
 
 ### FreeBSD
 
@@ -53,7 +54,7 @@ If you are on Linux with systemd:
 2. Remove files created by Nix:
 
    ```console
-   sudo rm -rf /etc/nix /usr/local/etc/profile.d/nix.sh /nix ~/.local/share/nix ~/.local/state/nix ~/.cache/nix ~/.nix-defexpr ~/.nix-profile ~/.nix-channels ~root/.nix-channels ~root/.nix-defexpr ~root/.nix-profile ~root/.cache/nix
+   sudo rm -rf /etc/nix /usr/local/etc/profile.d/nix.sh /nix ~root/.nix-channels ~root/.nix-defexpr ~root/.nix-profile ~root/.cache/nix
    ```
 
 3. Remove build users and their group:
@@ -153,7 +154,7 @@ If you are on Linux with systemd:
 6. Remove the files Nix added to your system, except for the store:
 
    ```console
-   sudo rm -rf /etc/nix /var/root/.nix-profile /var/root/.nix-defexpr /var/root/.nix-channels ~/.nix-profile ~/.nix-defexpr ~/.nix-channels ~/.local/share/nix ~/.local/state/nix ~/.cache/nix
+   sudo rm -rf /etc/nix /var/root/.nix-profile /var/root/.nix-defexpr /var/root/.nix-channels ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
    ```
 
 
@@ -191,6 +192,6 @@ If you are on Linux with systemd:
 To remove a [single-user installation](./installing-binary.md#single-user-installation) of Nix, run:
 
 ```console
-rm -rf /nix ~/.nix-channels ~/.nix-defexpr ~/.nix-profile ~/.local/share/nix ~/.local/state/nix ~/.cache/nix
+rm -rf /nix ~/.nix-channels ~/.nix-defexpr ~/.nix-profile
 ```
 You might also want to manually remove references to Nix from your `~/.profile`.

doc/manual/source/introduction.md

@@ -8,7 +8,7 @@ stores packages in the _Nix store_, usually the directory
 `/nix/store`, where each package has its own unique subdirectory such
 as
 
-    /nix/store/q06x3jll2yfzckz2bzqak089p43ixkkq-firefox-33.1/
+    /nix/store/b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z-firefox-33.1/
 
 where `b6gvzjyb2pg0…` is a unique identifier for the package that
 captures all its dependencies (it’s a cryptographic hash of the

doc/manual/source/language/advanced-attributes.md

@@ -338,7 +338,7 @@ Here is more information on the `output*` attributes, and what values they may b
     This will specify the output hash of the single output of a [fixed-output derivation].
 
     The `outputHash` attribute must be a string containing the hash in either hexadecimal or "nix32" encoding, or following the format for integrity metadata as defined by [SRI](https://www.w3.org/TR/SRI/).
-    The ["nix32" encoding](@docroot@/protocols/nix32.md) is Nix's variant of base-32 encoding.
+    The "nix32" encoding is an adaptation of base-32 encoding.
 
     > **Note**
     >

doc/manual/source/language/string-context.md

@@ -34,12 +34,12 @@ String context elements come in different forms:
     > [`builtins.storePath`] creates a string with a single constant string context element:
     >
     > ```nix
-    > builtins.getContext (builtins.storePath "/nix/store/ikwkxz4wwlp2g1428n7dy729cg1d9hin-hello-2.10")
+    > builtins.getContext (builtins.storePath "/nix/store/wkhdf9jinag5750mqlax6z2zbwhqb76n-hello-2.10")
     > ```
     > evaluates to
     > ```nix
     > {
-    >   "/nix/store/ikwkxz4wwlp2g1428n7dy729cg1d9hin-hello-2.10" = {
+    >   "/nix/store/wkhdf9jinag5750mqlax6z2zbwhqb76n-hello-2.10" = {
     >     path = true;
     >   };
     > }

doc/manual/source/language/string-interpolation.md

@@ -181,7 +181,7 @@ A derivation interpolates to the [store path] of its first [output](./derivation
 > "${pkgs.hello}"
 > ```
 >
->     "/nix/store/qnlr7906z0mrl2syrkdbpicffq02nw07-hello-2.12.1"
+>     "/nix/store/4xpfqf29z4m8vbhrqcz064wfmb46w5r7-hello-2.12.1"
 
 An attribute set interpolates to the return value of the function in the `__toString` applied to the attribute set itself.
 

doc/manual/source/language/syntax.md

@@ -51,7 +51,6 @@ See [String literals](string-literals.md).
 
   Path literals can also include [string interpolation], besides being [interpolated into other expressions].
 
-  [string interpolation]: ./string-interpolation.md
   [interpolated into other expressions]: ./string-interpolation.md#interpolated-expression
 
   At least one slash (`/`) must appear *before* any interpolated expression for the result to be recognized as a path.
@@ -273,7 +272,7 @@ will crash with an `infinite recursion encountered` error message.
 
 A let-expression allows you to define local variables for an expression.
 
-> *let-in* = `let` [ *identifier* = *expr* `;` ]... `in` *expr*
+> *let-in* = `let` [ *identifier* = *expr* ]... `in` *expr*
 
 Example:
 
@@ -286,27 +285,6 @@ in x + y
 
 This evaluates to `"foobar"`.
 
-There is also another, older, syntax for let expressions that should not be used in new code:
-
-> *let* = `let` `{` *identifier* = *expr* `;` [ *identifier* = *expr* `;`]...  `}`
-
-In this form, the attribute set between the `{` `}` is recursive.
-
-One of the attributes must have the special name `body`,
-which is the result of the expression.
-
-Example:
-
-```nix
-let {
-  foo = bar;
-  bar = "baz";
-  body = foo;
-}
-```
-
-This evaluates to "baz".
-
 ## Inheriting attributes
 
 When defining an [attribute set](./types.md#type-attrs) or in a [let-expression](#let-expressions) it is often convenient to copy variables from the surrounding lexical scope (e.g., when you want to propagate attributes).

doc/manual/source/package-management/binary-cache-substituter.md

@@ -19,16 +19,17 @@ whatever port you like:
 $ nix-serve -p 8080
 ```
 
-To check whether it works, try fetching the [`nix-cache-info`](@docroot@/protocols/nix-cache-info.md) file on the client:
+To check whether it works, try the following on the client:
 
 ```console
 $ curl http://avalon:8080/nix-cache-info
-StoreDir: /nix/store
-WantMassQuery: 1
-Priority: 30
 ```
 
-When writing to a binary cache (e.g., with [`nix copy`](@docroot@/command-ref/new-cli/nix3-copy.md)), Nix creates [`nix-cache-info`](@docroot@/protocols/nix-cache-info.md) automatically if it doesn't exist.
+which should print something like:
+
+    StoreDir: /nix/store
+    WantMassQuery: 1
+    Priority: 30
 
 On the client side, you can tell Nix to use your binary cache using
 `--substituters`, e.g.:

doc/manual/source/protocols/json/build-trace-entry.md

@@ -1,21 +1,27 @@
-{{#include build-trace-entry-v3-fixed.md}}
+{{#include build-trace-entry-v1-fixed.md}}
 
 ## Examples
 
 ### Simple build trace entry
 
 ```json
-{{#include schema/build-trace-entry-v3/simple.json}}
+{{#include schema/build-trace-entry-v1/simple.json}}
+```
+
+### Build trace entry with dependencies
+
+```json
+{{#include schema/build-trace-entry-v1/with-dependent-realisations.json}}
 ```
 
 ### Build trace entry with signature
 
 ```json
-{{#include schema/build-trace-entry-v3/with-structured-signature.json}}
+{{#include schema/build-trace-entry-v1/with-signature.json}}
 ```
 
 <!--
 ## Raw Schema
 
-[JSON Schema for Build Trace Entry v1](schema/build-trace-entry-v3.json)
--->
+[JSON Schema for Build Trace Entry v1](schema/build-trace-entry-v1.json)
+-->

doc/manual/source/protocols/json/meson.build

@@ -13,12 +13,11 @@ schemas = [
   'hash-v1',
   'content-address-v1',
   'store-path-v1',
-  'signature-v2',
-  'store-object-info-v3',
+  'store-object-info-v2',
   'derivation-v4',
   'derivation-options-v1',
   'deriving-path-v1',
-  'build-trace-entry-v3',
+  'build-trace-entry-v1',
   'build-result-v1',
   'store-v1',
 ]

doc/manual/source/protocols/json/schema/build-result-v1.yaml

@@ -83,7 +83,7 @@ properties:
         description: |
           A mapping from output names to their build trace entries.
         additionalProperties:
-          "$ref": "build-trace-entry-v3.yaml#/$defs/value"
+          "$ref": "build-trace-entry-v1.yaml"
 
   failure:
     type: object

doc/manual/source/protocols/json/schema/build-trace-entry-v1.yaml

@@ -0,0 +1,100 @@
+"$schema": "http://json-schema.org/draft-04/schema"
+"$id": "https://nix.dev/manual/nix/latest/protocols/json/schema/build-trace-entry-v1.json"
+title: Build Trace Entry
+description: |
+  A record of a successful build outcome for a specific derivation output.
+
+  This schema describes the JSON representation of a [build trace entry](@docroot@/store/build-trace.md).
+
+  > **Warning**
+  >
+  > This JSON format is currently
+  > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-ca-derivations)
+  > and subject to change.
+required:
+  - id
+  - outPath
+  - dependentRealisations
+  - signatures
+allOf:
+  - "$ref": "#/$defs/key"
+  - "$ref": "#/$defs/value"
+properties:
+  id: {}
+  outPath: {}
+  dependentRealisations: {}
+  signatures: {}
+additionalProperties: false
+
+"$defs":
+  key:
+    title: Build Trace Key
+    description: |
+      A [build trace entry](@docroot@/store/build-trace.md) is a key-value pair.
+      This is the "key" part, refering to a derivation and output.
+    type: object
+    required:
+      - id
+    properties:
+      id:
+        type: string
+        title: Derivation Output ID
+        pattern: "^sha256:[0-9a-f]{64}![a-zA-Z_][a-zA-Z0-9_-]*$"
+        description: |
+          Unique identifier for the derivation output that was built.
+
+          Format: `{hash-quotient-drv}!{output-name}`
+
+          - **hash-quotient-drv**: SHA-256 [hash of the quotient derivation](@docroot@/store/derivation/outputs/input-address.md#hash-quotient-drv).
+            Begins with `sha256:`.
+
+          - **output-name**: Name of the specific output (e.g., "out", "dev", "doc")
+
+          Example: `"sha256:ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad!foo"`
+
+  value:
+    title: Build Trace Value
+    description: |
+      A [build trace entry](@docroot@/store/build-trace.md) is a key-value pair.
+      This is the "value" part, describing an output.
+    type: object
+    required:
+      - outPath
+      - dependentRealisations
+      - signatures
+    properties:
+      outPath:
+        "$ref": "store-path-v1.yaml"
+        title: Output Store Path
+        description: |
+          The path to the store object that resulted from building this derivation for the given output name.
+
+      dependentRealisations:
+        type: object
+        title: Underlying Base Build Trace
+        description: |
+          This is for [*derived*](@docroot@/store/build-trace.md#derived) build trace entries to ensure coherence.
+
+          Keys are derivation output IDs (same format as the main `id` field).
+          Values are the store paths that those dependencies resolved to.
+
+          As described in the linked section on derived build trace traces, derived build trace entries must be kept in addition and not instead of the underlying base build entries.
+          This is the set of base build trace entries that this derived build trace is derived from.
+          (The set is also a map since this miniature base build trace must be coherent, mapping each key to a single value.)
+
+        patternProperties:
+          "^sha256:[0-9a-f]{64}![a-zA-Z_][a-zA-Z0-9_-]*$":
+            "$ref": "store-path-v1.yaml"
+            title: Dependent Store Path
+            description: Store path that this dependency resolved to during the build
+        additionalProperties: false
+
+      signatures:
+        type: array
+        title: Build Signatures
+        description: |
+          A set of cryptographic signatures attesting to the authenticity of this build trace entry.
+        items:
+          type: string
+          title: Signature
+          description: A single cryptographic signature

doc/manual/source/protocols/json/schema/build-trace-entry-v3.yaml

@@ -1,83 +0,0 @@
-"$schema": "http://json-schema.org/draft-04/schema"
-"$id": "https://nix.dev/manual/nix/latest/protocols/json/schema/build-trace-entry-v3.json"
-title: Build Trace Entry
-description: |
-  A record of a successful build outcome for a specific derivation output.
-
-  This schema describes the JSON representation of a [build trace entry](@docroot@/store/build-trace.md).
-
-  > **Warning**
-  >
-  > This JSON format is currently
-  > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-ca-derivations)
-  > and subject to change.
-
-  ## Version History
-
-  - Version 1: Original format
-
-  - Version 2:
-    - Remove `dependentRealisations`
-
-  - Version 3:
-    - Use `drvPath` not `drvHash` to refer to derivation in a more conventional way.
-    - Separate into `key` and `value`
-    - Use 2nd version of signatures format (objects, not strings)
-
-type: object
-required:
-  - key
-  - value
-properties:
-  key:
-    "$ref": "#/$defs/key"
-  value:
-    "$ref": "#/$defs/value"
-additionalProperties: false
-
-"$defs":
-  key:
-    title: Build Trace Key
-    description: |
-      A [build trace entry](@docroot@/store/build-trace.md) is a key-value pair.
-      This is the "key" part, refering to a derivation and output.
-    type: object
-    required:
-      - drvPath
-      - outputName
-    properties:
-      drvPath:
-        "$ref": "store-path-v1.yaml"
-        title: Derivation Path
-        description: |
-          The store path of the derivation that was built.
-      outputName:
-        type: string
-        title: Output Name
-        description: |
-          Name of the specific output (e.g., "out", "dev", "doc")
-    additionalProperties: false
-
-  value:
-    title: Build Trace Value
-    description: |
-      A [build trace entry](@docroot@/store/build-trace.md) is a key-value pair.
-      This is the "value" part, describing an output.
-    type: object
-    required:
-      - outPath
-      - signatures
-    properties:
-      outPath:
-        "$ref": "store-path-v1.yaml"
-        title: Output Store Path
-        description: |
-          The path to the store object that resulted from building this derivation for the given output name.
-
-      signatures:
-        type: array
-        title: Build Signatures
-        description: |
-          A set of cryptographic signatures attesting to the authenticity of this build trace entry.
-        items:
-          "$ref": "signature-v2.yaml"

doc/manual/source/protocols/json/schema/derivation-v4.yaml

@@ -94,8 +94,8 @@ properties:
           >
           > ```json
           > "srcs": [
-          >   "b8nwz167km1yciqpwzjj24f8jcy8pq1h-separate-debug-info.sh",
-          >   "ihzmilr413r8fb3ah30yjnhlb18c1laz-fix-pop-var-context-error.patch"
+          >   "47y241wqdhac3jm5l7nv0x4975mb1975-separate-debug-info.sh",
+          >   "56d0w71pjj9bdr363ym3wj1zkwyqq97j-fix-pop-var-context-error.patch"
           > ]
           > ```
         items:
@@ -140,7 +140,7 @@ properties:
     description: |
       Absolute path of the program used to perform the build.
       Typically this is the `bash` shell
-      (e.g. `/nix/store/p4xlj4imjbnm4v0x5jf4qysvyjjlgq1d-bash-4.4-p23/bin/bash`).
+      (e.g. `/nix/store/r3j288vpmczbl500w6zz89gyfa4nr0b1-bash-4.4-p23/bin/bash`).
 
   args:
     type: array

doc/manual/source/protocols/json/schema/hash-v1

@@ -1 +1 @@
-../../../../../../src/libutil-tests/data/hash
+../../../../../../src/libutil-tests/data/hash/

doc/manual/source/protocols/json/schema/nar-info-v3

@@ -1 +0,0 @@
-../../../../../../src/libstore-tests/data/nar-info/json-3

doc/manual/source/protocols/json/schema/signature-v2.yaml

@@ -1,33 +0,0 @@
-"$schema": "http://json-schema.org/draft-07/schema"
-"$id": "https://nix.dev/manual/nix/latest/protocols/json/schema/signature-v2.json"
-title: Signature
-description: |
-  A cryptographic signature along with the name of the key that produced it.
-
-  This schema describes the JSON representation of signatures as used in various Nix JSON APIs.
-
-  > **Warning**
-  >
-  > This JSON format is currently
-  > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-nix-command)
-  > and subject to change.
-
-  ## Version History
-
-  - Version 1: Colon-separated string in the format `<key-name>:<signature-in-Base64>`
-
-  - Version 2: Structured object with `keyName` and `sig` fields
-
-type: object
-required:
-  - keyName
-  - sig
-properties:
-  keyName:
-    type: string
-    title: Key Name
-    description: The name of the key used to produce this signature
-  sig:
-    type: string
-    title: Signature Data
-    description: The raw signature bytes, Base64-encoded

doc/manual/source/protocols/json/schema/signature-v2/simple.json

@@ -1,4 +0,0 @@
-{
-    "keyName": "cache.nixos.org-1",
-    "sig": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-}

doc/manual/source/protocols/json/schema/store-object-info-v2

@@ -0,0 +1 @@
+../../../../../../src/libstore-tests/data/path-info/json-2

doc/manual/source/protocols/json/schema/store-object-info-v2.yaml

@@ -1,6 +1,6 @@
 "$schema": "http://json-schema.org/draft-04/schema"
-"$id": "https://nix.dev/manual/nix/latest/protocols/json/schema/store-object-info-v3.json"
-title: Store Object Info v3
+"$id": "https://nix.dev/manual/nix/latest/protocols/json/schema/store-object-info-v2.json"
+title: Store Object Info v2
 description: |
   Information about a [store object](@docroot@/store/store-object.md).
 
@@ -50,10 +50,10 @@ $defs:
     properties:
       version:
         type: integer
-        const: 3
-        title: Format version (must be 3)
+        const: 2
+        title: Format version (must be 2)
         description: |
-          Must be `3`.
+          Must be `2`.
           This is a guard that allows us to continue evolving this format.
           Here is the rough version history:
 
@@ -63,8 +63,6 @@ $defs:
 
           - Version 2: Use structured JSON type for `ca`
 
-          - Version 3: Use structured JSON type for `signatures`
-
       path:
         "$ref": "./store-path-v1.yaml"
         title: Store Path
@@ -176,7 +174,7 @@ $defs:
 
           > This is an "impure" field that may not be included in certain contexts.
         items:
-          "$ref": "./signature-v2.yaml"
+          type: string
 
       # Computed closure fields
       closureSize:

doc/manual/source/protocols/json/schema/store-object-info-v3

@@ -1 +0,0 @@
-../../../../../../src/libstore-tests/data/path-info/json-3

doc/manual/source/protocols/json/schema/store-path-v1.yaml

@@ -24,7 +24,7 @@ description: |
 
   The format follows this pattern: `${digest}-${name}`
 
-  - **hash**: Digest rendered in [Nix32](@docroot@/protocols/nix32.md), a variant of base-32 (20 hash bytes become 32 ASCII characters)
+  - **hash**: Digest rendered in a custom variant of [Base32](https://en.wikipedia.org/wiki/Base32) (20 arbitrary bytes become 32 ASCII characters)
   - **name**: The package name and optional version/suffix information
 
 type: string

doc/manual/source/protocols/json/schema/store-v1.yaml

@@ -37,7 +37,7 @@ properties:
           - contents
         properties:
           info:
-            "$ref": "./store-object-info-v3.yaml#/$defs/impure"
+            "$ref": "./store-object-info-v2.yaml#/$defs/impure"
             title: Store Object Info
             description: |
               Metadata about the [store object](@docroot@/store/store-object.md) including hash, size, references, etc.
@@ -70,7 +70,7 @@ properties:
       "^[A-Za-z0-9+/]{43}=$":
         type: object
         additionalProperties:
-          "$ref": "./build-trace-entry-v3.yaml#/$defs/value"
+          "$ref": "./build-trace-entry-v1.yaml#/$defs/value"
     additionalProperties: false
 
 "$defs":

doc/manual/source/protocols/json/signature.md

@@ -1,9 +0,0 @@
-{{#include signature-v2-fixed.md}}
-
-## Examples
-
-### Simple signature
-
-```json
-{{#include schema/signature-v2/simple.json}}
-```

doc/manual/source/protocols/json/store-object-info.md

@@ -1,45 +1,45 @@
-{{#include store-object-info-v3-fixed.md}}
+{{#include store-object-info-v2-fixed.md}}
 
 ## Examples
 
 ### Minimal store object (content-addressed)
 
 ```json
-{{#include schema/store-object-info-v3/pure.json}}
+{{#include schema/store-object-info-v2/pure.json}}
 ```
 
 ### Store object with impure fields
 
 ```json
-{{#include schema/store-object-info-v3/impure.json}}
+{{#include schema/store-object-info-v2/impure.json}}
 ```
 
 ### Minimal store object (empty)
 
 ```json
-{{#include schema/store-object-info-v3/empty_pure.json}}
+{{#include schema/store-object-info-v2/empty_pure.json}}
 ```
 
 ### Store object with all impure fields
 
 ```json
-{{#include schema/store-object-info-v3/empty_impure.json}}
+{{#include schema/store-object-info-v2/empty_impure.json}}
 ```
 
 ### NAR info (minimal)
 
 ```json
-{{#include schema/nar-info-v3/pure.json}}
+{{#include schema/nar-info-v2/pure.json}}
 ```
 
 ### NAR info (with binary cache fields)
 
 ```json
-{{#include schema/nar-info-v3/impure.json}}
+{{#include schema/nar-info-v2/impure.json}}
 ```
 
 <!-- need to convert YAML to JSON first
 ## Raw Schema
 
-[JSON Schema for Store Object Info v1](schema/store-object-info-v3.json)
+[JSON Schema for Store Object Info v1](schema/store-object-info-v2.json)
 -->

doc/manual/source/protocols/nix-cache-info.md

@@ -1,55 +0,0 @@
-# Nix Cache Info Format
-
-The `nix-cache-info` file is a metadata file at the root of a [binary cache](@docroot@/package-management/binary-cache-substituter.md) (e.g., `https://cache.example.com/nix-cache-info`).
-
-MIME type: `text/x-nix-cache-info`
-
-## Format
-
-Line-based key-value format:
-
-```
-Key: value
-```
-
-Leading and trailing whitespace is trimmed from values.
-Lines without a colon are ignored.
-Unknown keys are silently ignored.
-
-## Fields
-
-### `StoreDir`
-
-The Nix store directory path that this cache was built for (e.g., `/nix/store`).
-
-If present, Nix verifies that this matches the client's store directory:
-
-```
-error: binary cache 'https://example.com' is for Nix stores with prefix '/nix/store', not '/home/user/nix/store'
-```
-
-### `WantMassQuery`
-
-`1` or `0`. Sets the default for [`want-mass-query`](@docroot@/store/types/http-binary-cache-store.md#store-http-binary-cache-store-want-mass-query).
-
-### `Priority`
-
-Integer. Sets the default for [`priority`](@docroot@/store/types/http-binary-cache-store.md#store-http-binary-cache-store-priority).
-
-## Example
-
-```
-StoreDir: /nix/store
-WantMassQuery: 1
-Priority: 30
-```
-
-## Caching Behavior
-
-Nix caches `nix-cache-info` in the [cache directory](@docroot@/command-ref/env-common.md#env-NIX_CACHE_HOME) with a 7-day TTL.
-
-## See Also
-
-- [HTTP Binary Cache Store](@docroot@/store/types/http-binary-cache-store.md)
-- [Serving a Nix store via HTTP](@docroot@/package-management/binary-cache-substituter.md)
-- [`substituters`](@docroot@/command-ref/conf-file.md#conf-substituters)

doc/manual/source/protocols/nix32.md

@@ -1,19 +0,0 @@
-# Nix32 Encoding
-
-Nix32 is Nix's variant of base-32 encoding, used for [store path digests](@docroot@/protocols/store-path.md), hash output via [`nix hash`](@docroot@/command-ref/new-cli/nix3-hash.md), and the [`outputHash`](@docroot@/language/advanced-attributes.md#adv-attr-outputHash) derivation attribute.
-
-## Alphabet
-
-The Nix32 alphabet consists of these 32 characters:
-
-```
-0 1 2 3 4 5 6 7 8 9 a b c d f g h i j k l m n p q r s v w x y z
-```
-
-The letters `e`, `o`, `u`, and `t` are omitted.
-
-## Byte Order
-
-Nix32 encoding processes the hash bytes from the end (last byte first), while base-16 encoding processes from the beginning (first byte first).
-
-Consequently, the string sort order is determined primarily by the first bytes for base-16, and by the last bytes for Nix32.

doc/manual/source/protocols/store-path.md

@@ -20,11 +20,12 @@ where
 
 - `store-dir` = the [store directory](@docroot@/store/store-path.md#store-directory)
 
-- `digest` = base-32 representation of the compressed to 160 bits [SHA-256] hash of `fingerprint`.
+- `digest` = base-32 representation of the compressed to 160 bits [SHA-256] hash of `fingerprint`
 
-  Nix uses a custom base-32 encoding called [Nix32](@docroot@/protocols/nix32.md).
-
-  For the definition of the hash compression algorithm, please refer to section 5.1 of the [Nix thesis](https://edolstra.github.io/pubs/phd-thesis.pdf).
+For the definition of the hash compression algorithm, please refer to the section 5.1 of
+the [Nix thesis](https://edolstra.github.io/pubs/phd-thesis.pdf), which also defines the
+specifics of base-32 encoding. Note that base-32 encoding processes the hash bytestring from
+the end, while base-16 processes in from the beginning.
 
 ## Fingerprint
 

doc/manual/source/release-notes/rl-0.12.md

@@ -80,7 +80,7 @@
           ...
         the following paths will be downloaded/copied (30.02 MiB):
           /nix/store/4m8pvgy2dcjgppf5b4cj5l6wyshjhalj-samba-3.2.4
-          /nix/store/spc1m987vlibchdx369qwa391s738s7l-libunwind-0.98.6
+          /nix/store/7h1kwcj29ip8vk26rhmx6bfjraxp0g4l-libunwind-0.98.6
           ...
 
   - Language features:

doc/manual/source/release-notes/rl-0.8.md

@@ -63,7 +63,7 @@ Nix 0.8 has the following improvements:
     can query all paths that directly or indirectly use a certain Glibc:
 
         $ nix-store -q --referrers-closure \
-            /nix/store/1a6mdrjz4wn7b9sfmcw5ggbk1mi281mh-glibc-2.3.4
+            /nix/store/8lz9yc6zgmc0vlqmn2ipcpkjlmbi51vv-glibc-2.3.4
 
   - The concept of fixed-output derivations has been formalised.
     Previously, functions such as `fetchurl` in Nixpkgs used a hack

doc/manual/source/release-notes/rl-2.0.md

@@ -66,7 +66,7 @@ This release has the following new features:
 
             nix copy --to ssh://machine nixpkgs.hello
 
-            nix copy --to ssh://machine /nix/store/qbhyj3blxpw2i6pb7c6grc9185nbnpvy-hello-2.10
+            nix copy --to ssh://machine /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10
 
             nix copy --to ssh://machine '(with import <nixpkgs> {}; hello)'
 
@@ -187,7 +187,7 @@ This release has the following new features:
         former is primarily useful in conjunction with remote stores,
         e.g.
 
-            nix ls-store --store https://cache.nixos.org/ -lR /nix/store/qbhyj3blxpw2i6pb7c6grc9185nbnpvy-hello-2.10
+            nix ls-store --store https://cache.nixos.org/ -lR /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10
 
         lists the contents of path in a binary cache.
 

doc/manual/source/release-notes/rl-2.13.md

@@ -25,7 +25,7 @@
 * Allow explicitly selecting outputs in a store derivation installable, just like we can do with other sorts of installables.
   For example,
   ```shell-session
-  # nix build /nix/store/fpq78s2h8ffh66v2iy0q1838mhff06y8-glibc-2.33-78.drv^dev
+  # nix build /nix/store/gzaflydcr6sb3567hap9q6srzx8ggdgg-glibc-2.33-78.drv^dev
   ```
   now works just as
   ```shell-session

doc/manual/source/release-notes/rl-2.15.md

@@ -18,13 +18,13 @@
 
   For example,
   ```shell-session
-  $ nix path-info /nix/store/fpq78s2h8ffh66v2iy0q1838mhff06y8-glibc-2.33-78.drv
+  $ nix path-info /nix/store/gzaflydcr6sb3567hap9q6srzx8ggdgg-glibc-2.33-78.drv
   ```
 
   now gives info about the derivation itself, while
 
   ```shell-session
-  $ nix path-info /nix/store/fpq78s2h8ffh66v2iy0q1838mhff06y8-glibc-2.33-78.drv^*
+  $ nix path-info /nix/store/gzaflydcr6sb3567hap9q6srzx8ggdgg-glibc-2.33-78.drv^*
   ```
   provides information about each of its outputs.
 

doc/manual/source/release-notes/rl-2.19.md

@@ -45,7 +45,7 @@
     ```json5
     [
       {
-        "path": "/nix/store/fvqsvk65d38p8qqir371ii0hyqxvjcw6-bash-5.2-p15",
+        "path": "/nix/store/8fv91097mbh5049i9rglc73dx6kjg3qk-bash-5.2-p15",
         "valid": true,
         // ...
       },
@@ -60,7 +60,7 @@
 
     ```json5
     {
-      "/nix/store/fvqsvk65d38p8qqir371ii0hyqxvjcw6-bash-5.2-p15": {
+      "/nix/store/8fv91097mbh5049i9rglc73dx6kjg3qk-bash-5.2-p15": {
         // ...
       },
       "/nix/store/wffw7l0alvs3iw94cbgi1gmmbmw99sqb-home-manager-path": null,

doc/manual/source/release-notes/rl-2.20.md

@@ -182,7 +182,7 @@
   «partially applied primop map»
 
   nix-repl> builtins.trace lib.id "my-value"
-  trace: «lambda id @ /nix/store/kgr5lnaiiv08wb7k324yv1i1npjmrvjc-source/lib/trivial.nix:26:5»
+  trace: «lambda id @ /nix/store/8rrzq23h2zq7sv5l2vhw44kls5w0f654-source/lib/trivial.nix:26:5»
   "my-value"
   ```
 

doc/manual/source/release-notes/rl-2.33.md

@@ -279,3 +279,35 @@ This release was made possible by the following 33 contributors:
 - Henry [**(@cootshk)**](https://github.com/cootshk)
 - Martin Joerg [**(@mjoerg)**](https://github.com/mjoerg)
 - Farid Zakaria [**(@fzakaria)**](https://github.com/fzakaria)
+# Release 2.33.3 (2026-02-13)
+
+- S3 binary caches now use virtual-hosted-style addressing by default [#15208](https://github.com/NixOS/nix/issues/15208)
+
+  S3 binary caches now use virtual-hosted-style URLs
+  (`https://bucket.s3.region.amazonaws.com/key`) instead of path-style URLs
+  (`https://s3.region.amazonaws.com/bucket/key`) when connecting to standard AWS
+  S3 endpoints. This enables HTTP/2 multiplexing and fixes TCP connection
+  exhaustion (TIME_WAIT socket accumulation) under high-concurrency workloads.
+
+  A new `addressing-style` store option controls this behavior:
+
+  - `auto` (default): virtual-hosted-style for standard AWS endpoints, path-style
+    for custom endpoints.
+  - `path`: forces path-style addressing (deprecated by AWS).
+  - `virtual`: forces virtual-hosted-style addressing (bucket names must not
+    contain dots).
+
+  Bucket names containing dots (e.g., `my.bucket.name`) automatically fall back
+  to path-style addressing in `auto` mode, because dotted names create
+  multi-level subdomains that break TLS wildcard certificate validation.
+
+  Example using path-style for backwards compatibility:
+
+  ```
+  s3://my-bucket/key?region=us-east-1&addressing-style=path
+  ```
+
+  Additionally, TCP keep-alive is now enabled on all HTTP connections, preventing
+  idle connections from being silently dropped by intermediate network devices
+  (NATs, firewalls, load balancers).
+

doc/manual/source/release-notes/rl-2.34.md

@@ -1,352 +0,0 @@
-# Release 2.34.0 (2026-02-27)
-
-## Highlights
-
-- Rust nix-installer in beta
-
-  The Rust-based rewrite of the Nix installer is now in beta.
-  We'd love help testing it out!
-
-  To test out the new installer, run:
-  ```
-  curl -sSfL https://artifacts.nixos.org/nix-installer | sh -s -- install
-  ```
-
-  This installer can be run even when you have an existing, script-based Nix installation without any adjustments.
-
-  This new installer also comes with the ability to uninstall your Nix installation; run:
-  ```
-  /nix/nix-installer uninstall
-  ```
-
-  This will get rid of your entire Nix installation (even if you installed over an existing, script-based installation).
-
-  This installer is a modified version of the [Determinate Nix Installer](https://github.com/DeterminateSystems/nix-installer) by Determinate Systems.
-  Thanks to Determinate Systems for all the investment they've put into the installer.
-
-  Source for the installer is in <https://github.com/NixOS/nix-installer>.
-  Report any issues in that repo.
-
-  For CI usage, a GitHub Action to install Nix using this installer is available at <https://github.com/NixOS/nix-installer-action>.
-
-- Stabilisation of `no-url-literals` experimental feature and new diagnostics infrastructure, with `lint-url-literals`, `lint-short-path-literals`, and `lint-absolute-path-literals` settings [#8738](https://github.com/NixOS/nix/issues/8738) [#10048](https://github.com/NixOS/nix/issues/10048) [#10281](https://github.com/NixOS/nix/issues/10281) [#15326](https://github.com/NixOS/nix/pull/15326)
-
-  Experimental feature `no-url-literals` has been stabilised and is now controlled by the `lint-url-literals` option.
-  New diagnostics infrastructure has been added for linting discouraged language features.
-
-  ### New lint infrastructure
-
-  #### [`lint-url-literals`](@docroot@/command-ref/conf-file.md#conf-lint-url-literals)
-
-  The `no-url-literals` experimental feature has been stabilised and replaced with a new [`lint-url-literals`](@docroot@/command-ref/conf-file.md#conf-lint-url-literals) setting.
-
-  To migrate from the experimental feature, replace:
-  ```
-  experimental-features = no-url-literals
-  ```
-  with:
-  ```
-  lint-url-literals = fatal
-  ```
-
-  #### [`lint-short-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-short-path-literals)
-
-  The [`warn-short-path-literals`](@docroot@/command-ref/conf-file.md#conf-warn-short-path-literals) boolean setting has been deprecated and replaced with [`lint-short-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-short-path-literals).
-
-  To migrate, replace:
-  ```
-  warn-short-path-literals = true
-  ```
-  with:
-  ```
-  lint-short-path-literals = warn
-  ```
-
-  #### [`lint-absolute-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-absolute-path-literals)
-
-  A new [`lint-absolute-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-absolute-path-literals) setting has been added to control handling of absolute path literals (paths starting with `/`) and home path literals (paths starting with `~/`).
-
-  #### Setting values
-
-  All three settings accept three values:
-  - `ignore`: Allow the feature without emitting any diagnostic (default)
-  - `warn`: Emit a warning when the feature is used
-  - `fatal`: Treat the feature as a parse error
-
-  The defaults may change in future versions.
-
-- Improved parser error messages [#15092](https://github.com/NixOS/nix/pull/15092)
-
-  Parser error messages now use legible strings for tokens instead of internal names. For example, malformed expression `a ++ ++ b` now produces the following error:
-  ```
-  error: syntax error, unexpected '++'
-       at «string»:1:6:
-            1| a ++ ++ b
-             |      ^
-  ```
-
-  Instead of:
-  ```
-  error: syntax error, unexpected CONCAT
-       at «string»:1:6:
-            1| a ++ ++ b
-             |      ^
-  ```
-
-## New features
-
-- `nix repl` now supports `inherit` and multiple bindings [#15082](https://github.com/NixOS/nix/pull/15082)
-
-  The `nix repl` now supports `inherit` statements and multiple bindings per line:
-
-  ```
-  nix-repl> a = { x = 1; y = 2; }
-  nix-repl> inherit (a) x y
-  nix-repl> x + y
-  3
-
-  nix-repl> p = 1; q = 2;
-  nix-repl> p + q
-  3
-
-  nix-repl> foo.bar.baz = 1;
-  nix-repl> foo.bar
-  { baz = 1; }
-  ```
-
-- New command `nix store roots-daemon` for serving GC roots [#15143](https://github.com/NixOS/nix/pull/15143)
-
-  New command [`nix store roots-daemon`](@docroot@/command-ref/new-cli/nix3-store-roots-daemon.md) runs a daemon that serves garbage collector roots over a Unix domain socket.
-  It enables the garbage collector to discover runtime roots when the main Nix daemon doesn't have `CAP_SYS_PTRACE` capability and therefore cannot scan `/proc`.
-
-  The garbage collector can be configured to use this daemon via the [`use-roots-daemon`](@docroot@/store/types/local-store.md#store-experimental-option-use-roots-daemon) store setting.
-
-  This feature requires the [`local-overlay-store` experimental feature](@docroot@/development/experimental-features.md#xp-feature-local-overlay-store).
-
-- New command `nix-nswrapper` in `libexec` [#15183](https://github.com/NixOS/nix/pull/15183)
-
-  The new command `libexec/nix-nswrapper` is used to run the Nix daemon in an unprivileged user namespace on Linux. In order to use this command, build user UIDs and GIDs must be allocated in `/etc/subuid` and `/etc/subgid`.
-
-  It can be used to run the Nix daemon with full sandboxing without executing as root. Support has been added to Nixpkgs with the new `nix.daemonUser` and `nix.daemonGroup` settings.
-
-- New setting `ignore-gc-delete-failure` for local stores [#15054](https://github.com/NixOS/nix/pull/15054)
-
-  A new local store setting [`ignore-gc-delete-failure`](@docroot@/store/types/local-store.md#store-local-store-ignore-gc-delete-failure) has been added.
-  When enabled, garbage collection will log warnings instead of failing when it cannot delete store paths.
-  This is useful when running Nix as an unprivileged user that may not have write access to all paths in the store.
-
-  This setting is experimental and requires the [`local-overlay-store`](@docroot@/development/experimental-features.md#xp-feature-local-overlay-store) experimental feature.
-
-- New setting `narinfo-cache-meta-ttl` [#15287](https://github.com/NixOS/nix/pull/15287)
-
-  The new setting `narinfo-cache-meta-ttl` controls how long binary cache metadata (i.e. `/nix-cache-info`) is cached locally, in seconds. This was previously hard-coded to 7 days, which is still the default. As a result, you can now use `nix store info --refresh` to check whether a binary cache is still valid.
-
-- Support HTTPS binary caches using mTLS (client certificate) authentication [#13002](https://github.com/NixOS/nix/issues/13002) [#13030](https://github.com/NixOS/nix/pull/13030)
-
-  Added support for `tls-certificate` and `tls-private-key` options in substituter URLs.
-
-  Example:
-
-  ```
-  https://substituter.invalid?tls-certificate=/path/to/cert.pem&tls-private-key=/path/to/key.pem
-  ```
-
-  When these options are configured, Nix will use this certificate/private key pair to authenticate to the server.
-
-- `nix store gc --dry-run` and `nix-collect-garbage --dry-run` now report the number of paths that would be freed [#15229](https://github.com/NixOS/nix/pull/15229) [#5704](https://github.com/NixOS/nix/issues/5704)
-
-## Performance improvements
-
-- Unpacking tarballs to `~/.cache/nix/tarball-cache-v2` is now multithreaded [#12087](https://github.com/NixOS/nix/pull/12087)
-
-  Content-addressed cache for `builtins.fetchTarball` and tarball-based flake inputs (e.g. `github:NixOS/nixpkgs`, `https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz`) now writes git blobs (files) to the `tarball-cache-v2` repository concurrently, which significantly reduces the wall time for tarball unpacking (up to ~1.8x faster unpacking for `https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz` in our testing).
-
-  Currently, Nix doesn't perform any maintenance on the `~/.cache/nix/tarball-cache-v2` repository, which will be addressed in future versions. Users that wish to reclaim disk space used by the tarball cache may want to run:
-
-  ```
-  rm -rf ~/.cache/nix/tarball-cache # Historical tarball-cache, not used by Nix >= 2.33
-  cd ~/.cache/nix/tarball-cache-v2 && git multi-pack-index write && git multi-pack-index repack && git multi-pack-index expire
-  ```
-
-- `nix nar ls` and other NAR listing operations have been optimised further [#15163](https://github.com/NixOS/nix/pull/15163)
-
-- Evaluator hot-path optimizations [#15270](https://github.com/NixOS/nix/pull/15270) [#15271](https://github.com/NixOS/nix/pull/15271)
-
-## C API Changes
-
-- New store API methods [#14766](https://github.com/NixOS/nix/pull/14766) [#14768](https://github.com/NixOS/nix/pull/14768)
-
-  The C API now includes additional methods:
-
-  - `nix_store_query_path_from_hash_part()` - Get the full store path given its hash part
-  - `nix_store_copy_path()` - Copy a single store path between two stores, allows repairs and configuring signature checking
-
-- Errors returned from your primops are not treated as recoverable by default [#13930](https://github.com/NixOS/nix/pull/13930) [#15286](https://github.com/NixOS/nix/pull/15286)
-
-  Nix 2.34 by default remembers the error in the thunk that triggered it.
-
-  Previously the following sequence of events worked:
-
-  1. Have a thunk that invokes a primop that's defined through the C API
-  2. The primop returns an error
-  3. Force the thunk again
-  4. The primop returns a value
-  5. The thunk evaluated successfully
-
-  **Resolution**
-
-  C API consumers that rely on this must change their recoverable error calls:
-
-  ```diff
-  -nix_set_err_msg(context, NIX_ERR_*, msg);
-  +nix_set_err_msg(context, NIX_ERR_RECOVERABLE, msg);
-  ```
-
-## Bug fixes
-
-- Avoid dropping ssh connections with `ssh-ng://` stores for store path copying [#14998](https://github.com/NixOS/nix/pull/14998) [#6950](https://github.com/NixOS/nix/issues/6950)
-
-  Due to a bug in how Nix handled Boost.Coroutine2 suspension and resumption, copying from `ssh-ng://` stores would drop the SSH connection for each copied path. This issue has been fixed, which improves performance by avoiding multiple SSH/Nix Worker Protocol handshakes.
-
-- S3 binary caches now use virtual-hosted-style addressing by default [#15208](https://github.com/NixOS/nix/issues/15208) [#15216](https://github.com/NixOS/nix/pull/15216)
-
-  S3 binary caches now use virtual-hosted-style URLs
-  (`https://bucket.s3.region.amazonaws.com/key`) instead of path-style URLs
-  (`https://s3.region.amazonaws.com/bucket/key`) when connecting to standard AWS
-  S3 endpoints. This enables HTTP/2 multiplexing and fixes TCP connection
-  exhaustion (TIME_WAIT socket accumulation) under high-concurrency workloads.
-
-  A new `addressing-style` store option controls this behavior:
-
-  - `auto` (default): virtual-hosted-style for standard AWS endpoints, path-style
-    for custom endpoints.
-  - `path`: forces path-style addressing (deprecated by AWS).
-  - `virtual`: forces virtual-hosted-style addressing (bucket names must not
-    contain dots).
-
-  Bucket names containing dots (e.g., `my.bucket.name`) automatically fall back
-  to path-style addressing in `auto` mode, because dotted names create
-  multi-level subdomains that break TLS wildcard certificate validation.
-
-  Example using path-style for backwards compatibility:
-
-  ```
-  s3://my-bucket/key?region=us-east-1&addressing-style=path
-  ```
-
-  Additionally, TCP keep-alive is now enabled on all HTTP connections, preventing
-  idle connections from being silently dropped by intermediate network devices
-  (NATs, firewalls, load balancers).
-
-- `nix-prefetch-url --unpack` now properly checks for empty archives [#15242](https://github.com/NixOS/nix/pull/15242)
-
-  Prior versions failed to check for empty archives and would crash with a `nullptr` dereference when unpacking empty archives.
-  This is now fixed.
-
-- Prevent runaway processes when Nix is killed with `SIGKILL` when building in a local store with build users [#15193](https://github.com/NixOS/nix/pull/15193)
-
-  When run as root, Nix doesn't run builds via the daemon and is a parent of the forked build processes. Prior versions of Nix failed to preserve the `PR_SET_PDEATHSIG` parent-death signal across `setuid` calls. This could lead to build processes being reparented and continue running in the background. This has been fixed.
-
-- Fix crash when interrupting `--log-format internal-json` [#15335](https://github.com/NixOS/nix/pull/15335)
-
-  Pressing Ctrl-C during `--log-format internal-json` (used by [nix-output-monitor](https://github.com/maralorn/nix-output-monitor)) no longer causes a spurious "Nix crashed. This is a bug." report.
-
-- Fix percent-encoding in `file://` and `local://` store URIs [#15280](https://github.com/NixOS/nix/pull/15280)
-
-  Store URIs with special characters like `+` in the path (e.g. `file:///tmp/a+b`) no longer incorrectly create percent-encoded directories (e.g. `/tmp/a%2Bb`).
-
-- Fix crash during tab completion in `nix repl` [#15255](https://github.com/NixOS/nix/pull/15255)
-
-- Fix "Too many open files" on macOS [#15205](https://github.com/NixOS/nix/pull/15205)
-
-  Nix now raises the open file soft limit to the hard limit at startup, fixing "Too many open files" errors on macOS where the default soft limit is low.
-
-- `nix develop` no longer fails when `inputs.nixpkgs` has `flake = false` [#15175](https://github.com/NixOS/nix/pull/15175)
-
-- `builtins.flakeRefToString` no longer fails with "attribute is a thunk" [#15160](https://github.com/NixOS/nix/pull/15160)
-
-- Fix `QueryPathInfo` throwing on invalid paths in the daemon [#15134](https://github.com/NixOS/nix/pull/15134)
-
-- `nix-store --generate-binary-cache-key` now fsyncs key files to prevent corruption [#15107](https://github.com/NixOS/nix/pull/15107)
-
-- Fix `build-hook` setting in `nix.conf` being ignored [#15083](https://github.com/NixOS/nix/pull/15083)
-
-- Fix empty error messages when builds are cancelled due to a dependency failure [#14972](https://github.com/NixOS/nix/pull/14972)
-
-  When a build fails without `--keep-going`, other in-progress builds are cancelled. Previously, these cancelled builds were incorrectly reported as failed with empty error messages. This affected `buildPathsWithResults` callers such as `nix flake check`.
-
-## Miscellaneous changes
-
-- Content-Encoding decompression is now handled by libcurl [#14324](https://github.com/NixOS/nix/issues/14324) [#15336](https://github.com/NixOS/nix/pull/15336)
-
-  Transparent decompression of HTTP downloads specifying `Content-Encoding` header now uses libcurl. This adds support for previously advertised, but not supported `deflate` encoding as well as deprecated `x-gzip` alias.
-  Non-standard `xz`, `bzip2` encodings that were previously advertised are no longer supported, as they do not commonly appear in the wild and should not be sent by compliant servers.
-
-  `br`, `zstd`, `gzip` continue to be supported. Distro packaging should ensure that the `libcurl` dependency is linked against required libraries to support these encodings. By default, the build system now requires libcurl >= 8.17.0, which is not known to have issues around [pausing and decompression](https://github.com/curl/curl/issues/16280).
-
-- Static builds now support S3 features (`libstore:s3-aws-auth` meson option) [#15076](https://github.com/NixOS/nix/pull/15076)
-
-- Improved package-related error messages [#15349](https://github.com/NixOS/nix/pull/15349)
-
-  Store path context is now rendered in the user-facing `hash^out` format instead of the internal `!out!hash` format.
-  A misleading error message in `nix-env` that incorrectly blamed content-addressed derivations has been fixed.
-
-- Improved error message for empty derivation files [#15298](https://github.com/NixOS/nix/pull/15298)
-
-  Parsing an empty `.drv` file (e.g. due to store corruption after an unclean shutdown) now produces a clear error message instead of the cryptic `expected string 'D'`.
-
-- Relative `file:` paths for tarballs are now rejected with a clear error [#14983](https://github.com/NixOS/nix/pull/14983)
-
-- Continued progress on the Windows port, including build fixes, CI improvements, and platform abstractions.
-
-- Nix docker images are now uploaded to [GHCR](https://github.com/NixOS/nix/pkgs/container/nix) as part of the release process
-
-  Historically, only pre-release builds of `amd64` docker images have been uploaded to ghcr.io with the `latest` tag pointing to the last built image from `master` branch. This has been fixed and going forward, <https://github.com/NixOS/nix/pkgs/container/nix> will include the same images as <https://hub.docker.com/r/nixos/nix/> that are built by [Hydra](https://hydra.nixos.org/project/nix) for [arm64](https://hydra.nixos.org/job/nix/maintenance-2.34/dockerImage.aarch64-linux) and [amd64](https://hydra.nixos.org/job/nix/maintenance-2.34/dockerImage.x86_64-linux). Pre-release versions are no longer pushed to the registry.
-
-## Contributors
-
-This release was made possible by the following 43 contributors:
-
-- Taeer Bar-Yam [**(@Radvendii)**](https://github.com/Radvendii)
-- Sergei Zimmerman [**(@xokdvium)**](https://github.com/xokdvium)
-- Jörg Thalheim [**(@Mic92)**](https://github.com/Mic92)
-- Graham Dennis [**(@GrahamDennis)**](https://github.com/GrahamDennis)
-- Damien Diederen [**(@ztzg)**](https://github.com/ztzg)
-- koberbe-jh [**(@koberbe-jh)**](https://github.com/koberbe-jh)
-- Robert Hensing [**(@roberth)**](https://github.com/roberth)
-- Bouke van der Bijl [**(@bouk)**](https://github.com/bouk)
-- Lisanna Dettwyler [**(@lisanna-dettwyler)**](https://github.com/lisanna-dettwyler)
-- kiara [**(@KiaraGrouwstra)**](https://github.com/KiaraGrouwstra)
-- Side Effect [**(@YawKar)**](https://github.com/YawKar)
-- dram [**(@dramforever)**](https://github.com/dramforever)
-- tomf [**(@tomfitzhenry)**](https://github.com/tomfitzhenry)
-- Kamil Monicz [**(@Zaczero)**](https://github.com/Zaczero)
-- Cosima Neidahl [**(@OPNA2608)**](https://github.com/OPNA2608)
-- Siddhant Kumar [**(@siddhantk232)**](https://github.com/siddhantk232)
-- Jens Petersen [**(@juhp)**](https://github.com/juhp)
-- Johannes Kirschbauer [**(@hsjobeki)**](https://github.com/hsjobeki)
-- tomberek [**(@tomberek)**](https://github.com/tomberek)
-- Eelco Dolstra [**(@edolstra)**](https://github.com/edolstra)
-- Artemis Tosini [**(@artemist)**](https://github.com/artemist)
-- David McFarland [**(@corngood)**](https://github.com/corngood)
-- Tucker Shea [**(@NoRePercussions)**](https://github.com/NoRePercussions)
-- Connor Baker [**(@ConnorBaker)**](https://github.com/ConnorBaker)
-- Cole Helbling [**(@cole-h)**](https://github.com/cole-h)
-- Eveeifyeve [**(@Eveeifyeve)**](https://github.com/Eveeifyeve)
-- John Ericson [**(@Ericson2314)**](https://github.com/Ericson2314)
-- Graham Christensen [**(@grahamc)**](https://github.com/grahamc)
-- Ilja [**(@iljah)**](https://github.com/iljah)
-- Pol Dellaiera [**(@drupol)**](https://github.com/drupol)
-- steelman [**(@steelman)**](https://github.com/steelman)
-- Brian McKenna [**(@puffnfresh)**](https://github.com/puffnfresh)
-- JustAGuyTryingHisBest [**(@JustAGuyTryingHisBest)**](https://github.com/JustAGuyTryingHisBest)
-- zowoq [**(@zowoq)**](https://github.com/zowoq)
-- Agustín Covarrubias [**(@agucova)**](https://github.com/agucova)
-- Sergei Trofimovich [**(@trofi)**](https://github.com/trofi)
-- Bernardo Meurer [**(@lovesegfault)**](https://github.com/lovesegfault)
-- Peter Bynum [**(@pkpbynum)**](https://github.com/pkpbynum)
-- Amaan Qureshi [**(@amaanq)**](https://github.com/amaanq)
-- Michael Hoang [**(@Enzime)**](https://github.com/Enzime)
-- Michael Daniels [**(@mdaniels5757)**](https://github.com/mdaniels5757)
-- Matthew Kenigsberg [**(@mkenigs)**](https://github.com/mkenigs)
-- Shea Levy [**(@shlevy)**](https://github.com/shlevy)

doc/manual/source/store/store-path.md

@@ -2,7 +2,7 @@
 
 > **Example**
 >
-> `/nix/store/jf6gn2dzna4nmsfbdxsd7kwhsk6gnnlr-git-2.38.1`
+> `/nix/store/a040m110amc4h71lds2jmr8qrkj2jhxd-git-2.38.1`
 >
 > A rendered store path
 
@@ -22,7 +22,7 @@ Store paths are pairs of
 
 > **Example**
 >
-> - Digest: `q06x3jll2yfzckz2bzqak089p43ixkkq`
+> - Digest: `b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z`
 > - Name:   `firefox-33.1`
 
 To make store objects accessible to operating system processes, stores have to expose store objects through the file system.
@@ -31,14 +31,14 @@ A store path is rendered to a file system path as the concatenation of
 
 - [Store directory](#store-directory) (typically `/nix/store`)
 - Path separator (`/`)
-- Digest rendered in [Nix32](@docroot@/protocols/nix32.md), a variant of base-32 (20 hash bytes become 32 ASCII characters)
+- Digest rendered in a custom variant of [Base32](https://en.wikipedia.org/wiki/Base32) (20 arbitrary bytes become 32 ASCII characters)
 - Hyphen (`-`)
 - Name
 
 > **Example**
 >
 > ```
->   /nix/store/q06x3jll2yfzckz2bzqak089p43ixkkq-firefox-33.1
+>   /nix/store/b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z-firefox-33.1
 >   |--------| |------------------------------| |----------|
 > store directory            digest                 name
 > ```

doc/manual/source/store/types/index.md.in

@@ -8,7 +8,7 @@ Stores are specified using a URL-like syntax. For example, the command
 
 ```console
 # nix path-info --store https://cache.nixos.org/ --json \
-  /nix/store/1542dip9i7k4f24y6hqgd04hmvid9hr5-coreutils-9.1
+  /nix/store/a7gvj343m05j2s32xcnwr35v31ynlypr-coreutils-9.1
 ```
 
 fetches information about a store path in the HTTP binary cache

docker.nix

@@ -358,6 +358,7 @@ dockerTools.buildLayeredImageWithNixDb {
 
   extraCommands = ''
     rm -rf nix-support
+    ln -s /nix/var/nix/profiles nix/var/nix/gcroots/profiles
   '';
   fakeRootCommands = ''
     chmod 1777 tmp

flake.lock

@@ -3,15 +3,15 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1767039857,
-        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "NixOS",
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "edolstra",
         "repo": "flake-compat",
         "type": "github"
       }
@@ -63,15 +63,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1771903837,
-        "narHash": "sha256-jEA8WggGKtMFeNeCKq3NK8cLEjJmG6/RLUElYYbBZ0E=",
-        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
+        "lastModified": 1763948260,
+        "narHash": "sha256-zZk7fn2ARAqmLwaYTpxBJmj81KIdz11NiWt7ydHHD/M=",
+        "rev": "1c8ba8d3f7634acac4a2094eef7c32ad9106532c",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.6495.e764fc9a4058/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/25.05/nixos-25.05.813095.1c8ba8d3f763/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz"
+        "url": "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz"
       }
     },
     "nixpkgs-23-11": {

flake.nix

@@ -1,12 +1,12 @@
 {
   description = "The purely functional package manager";
 
-  inputs.nixpkgs.url = "https://channels.nixos.org/nixos-25.11/nixexprs.tar.xz";
+  inputs.nixpkgs.url = "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz";
 
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
   inputs.nixpkgs-23-11.url = "github:NixOS/nixpkgs/a62e6edd6d5e1fa0329b8653c801147986f8d446";
   inputs.flake-compat = {
-    url = "github:NixOS/flake-compat";
+    url = "github:edolstra/flake-compat";
     flake = false;
   };
 
@@ -32,7 +32,7 @@
     let
       inherit (nixpkgs) lib;
 
-      officialRelease = false;
+      officialRelease = true;
 
       linux32BitSystems = [ "i686-linux" ];
       linux64BitSystems = [
@@ -115,9 +115,6 @@
                     }
                     // lib.optionalAttrs (crossSystem == "x86_64-unknown-freebsd13") {
                       useLLVM = true;
-                    }
-                    // lib.optionalAttrs (crossSystem == "x86_64-w64-mingw32") {
-                      emulator = pkgs: "${pkgs.buildPackages.wineWow64Packages.stable_11}/bin/wine";
                     };
                 overlays = [
                   (overlayFor (pkgs: pkgs.${stdenv}))
@@ -409,10 +406,6 @@
 
               "nix-cmd" = { };
 
-              "nix-nswrapper" = {
-                linuxOnly = true;
-              };
-
               "nix-cli" = { };
 
               "nix-everything" = { };
@@ -425,6 +418,10 @@
                 supportsCross = false;
               };
 
+              "nix-kaitai-struct-checks" = {
+                supportsCross = false;
+              };
+
               "nix-perl-bindings" = {
                 supportsCross = false;
               };
@@ -433,37 +430,32 @@
               pkgName:
               {
                 supportsCross ? true,
-                linuxOnly ? false,
               }:
-              lib.optionalAttrs (linuxOnly -> nixpkgsFor.${system}.native.stdenv.hostPlatform.isLinux) (
-                {
-                  # These attributes go right into `packages.<system>`.
-                  "${pkgName}" = nixpkgsFor.${system}.native.nixComponents2.${pkgName};
-                  "${pkgName}-static" = nixpkgsFor.${system}.native.pkgsStatic.nixComponents2.${pkgName};
-                  "${pkgName}-llvm" = nixpkgsFor.${system}.native.pkgsLLVM.nixComponents2.${pkgName};
-                }
-                // flatMapAttrs (lib.genAttrs stdenvs (_: { })) (
-                  stdenvName:
-                  { }:
-                  {
-                    # These attributes go right into `packages.<system>`.
-                    "${pkgName}-${stdenvName}" =
-                      nixpkgsFor.${system}.nativeForStdenv.${stdenvName}.nixComponents2.${pkgName};
-                  }
-                )
-              )
+              {
+                # These attributes go right into `packages.<system>`.
+                "${pkgName}" = nixpkgsFor.${system}.native.nixComponents2.${pkgName};
+                "${pkgName}-static" = nixpkgsFor.${system}.native.pkgsStatic.nixComponents2.${pkgName};
+                "${pkgName}-llvm" = nixpkgsFor.${system}.native.pkgsLLVM.nixComponents2.${pkgName};
+              }
               // lib.optionalAttrs supportsCross (
                 flatMapAttrs (lib.genAttrs crossSystems (_: { })) (
                   crossSystem:
                   { }:
-                  lib.optionalAttrs
-                    (linuxOnly -> nixpkgsFor.${system}.cross.${crossSystem}.stdenv.hostPlatform.isLinux)
-                    {
-                      # These attributes go right into `packages.<system>`.
-                      "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.nixComponents2.${pkgName};
-                    }
+                  {
+                    # These attributes go right into `packages.<system>`.
+                    "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.nixComponents2.${pkgName};
+                  }
                 )
               )
+              // flatMapAttrs (lib.genAttrs stdenvs (_: { })) (
+                stdenvName:
+                { }:
+                {
+                  # These attributes go right into `packages.<system>`.
+                  "${pkgName}-${stdenvName}" =
+                    nixpkgsFor.${system}.nativeForStdenv.${stdenvName}.nixComponents2.${pkgName};
+                }
+              )
             )
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
           dockerImage =

maintainers/flake-module.nix

@@ -88,28 +88,16 @@
               ''^tests/functional/lang/eval-fail-path-slash\.nix$''
               ''^tests/functional/lang/eval-fail-toJSON-non-utf-8\.nix$''
               ''^tests/functional/lang/eval-fail-set\.nix$''
-
-              # Language tests, don't churn the formatting of strings
-              ''^tests/functional/lang/eval-fail-fromTOML-overflow\.nix$''
-              ''^tests/functional/lang/eval-fail-fromTOML-underflow\.nix$''
-              ''^tests/functional/lang/eval-fail-bad-string-interpolation-3\.nix$''
-              ''^tests/functional/lang/eval-fail-bad-string-interpolation-4\.nix$''
-              ''^tests/functional/lang/eval-okay-regex-match2\.nix$''
-
-              # URL literal tests - nixfmt converts unquoted URLs to strings
-              ''^tests/functional/lang/eval-fail-url-literal\.nix$''
-              ''^tests/functional/lang/eval-okay-url-literal-warn\.nix$''
-              ''^tests/functional/lang/eval-okay-url-literal-default\.nix$''
             ];
           };
           clang-format = {
             enable = true;
             # https://github.com/cachix/git-hooks.nix/pull/532
-            package = pkgs.llvmPackages_21.clang-tools;
+            package = pkgs.llvmPackages_latest.clang-tools;
             excludes = [
               # We don't want to format test data
               # ''tests/(?!nixos/).*\.nix''
-              "^src/[^/]*-tests/data/.*$"
+              ''^src/[^/]*-tests/data/.*$''
 
               # Don't format vendored code
               ''^doc/manual/redirects\.js$''

maintainers/invalidate-store-paths.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-set -x
-
-git ls-files -z \
-    | xargs -0 grep -o '[0123456789abcdfghijklmnpqrsvwxyz]\{32\}' 2> /dev/null \
-    | rev \
-    | cut -d: -f1 \
-    | rev \
-    | sort \
-    | uniq \
-    | while read -r oldhash; do
-        if ! curl --fail -I "https://cache.nixos.org/$oldhash.narinfo" > /dev/null 2>&1; then
-            continue
-        fi
-
-        newhash=$(
-            nix eval --expr "builtins.toFile \"006c6ssvddri1sg34wnw65mzd05pcp3qliylxlhv49binldajba5\" \"$oldhash\"" \
-                | cut -d- -f1 \
-                | cut -d/ -f4
-        )
-
-        msg=$(printf "bad: %s -> %s" "$oldhash" "$newhash")
-        echo "$msg"
-        git ls-files -z \
-            | xargs -0 grep -a -l "$oldhash" 2> /dev/null \
-            | while read -r file; do
-                [ -L "$file" ] && continue
-                perl -pi -e "s/$oldhash/$newhash/g" "$file" || true
-            done || true
-        git commit -am "$msg"
-    done

meson.build

@@ -24,10 +24,6 @@ subproject('libcmd')
 # Executables
 subproject('nix')
 
-if host_machine.system() == 'linux'
-  subproject('nswrapper')
-endif
-
 # Docs
 if get_option('doc-gen')
   subproject('internal-api-docs')
@@ -67,3 +63,6 @@ subproject('nix-functional-tests')
 if get_option('json-schema-checks')
   subproject('json-schema-checks')
 endif
+if get_option('kaitai-struct-checks')
+  subproject('kaitai-struct-checks')
+endif

meson.options

@@ -28,6 +28,13 @@ option(
   description : 'Build benchmarks (requires gbenchmark)',
 )
 
+option(
+  'kaitai-struct-checks',
+  type : 'boolean',
+  value : true,
+  description : 'Check the Kaitai Struct specifications (requires Kaitai Struct)',
+)
+
 option(
   'json-schema-checks',
   type : 'boolean',

misc/systemd/nix-daemon.service.in

@@ -11,7 +11,7 @@ ExecStart=@@bindir@/nix-daemon nix-daemon --daemon
 KillMode=process
 LimitNOFILE=1048576
 TasksMax=1048576
-Delegate=
+Delegate=yes
 
 [Install]
 WantedBy=multi-user.target

nix-meson-build-support/common/asan-options/meson.build

@@ -1,7 +1,7 @@
 # Clang gets grumpy about missing libasan symbols if -shared-libasan is not
 # passed when building shared libs, at least on Linux
 if cxx.get_id() == 'clang' and ('address' in get_option('b_sanitize') or 'undefined' in get_option(
-    'b_sanitize',
+  'b_sanitize',
 ))
   add_project_link_arguments('-shared-libasan', language : 'cpp')
 endif

nix-meson-build-support/common/meson.build

@@ -22,8 +22,6 @@ add_project_arguments(
   '-Werror=undef',
   '-Werror=unused-result',
   '-Werror=sign-compare',
-  '-Werror=return-type',
-  '-Werror=non-virtual-dtor',
   '-Wignored-qualifiers',
   '-Wimplicit-fallthrough',
   '-Wno-deprecated-declarations',
@@ -33,13 +31,6 @@ add_project_arguments(
 # GCC doesn't benefit much from precompiled headers.
 do_pch = cxx.get_id() == 'clang'
 
-if cxx.get_id() == 'gcc'
-  add_project_arguments(
-    '-Wno-interference-size', # Used for C++ ABI only. We don't provide any guarantees about different march tunings.
-    language : 'cpp',
-  )
-endif
-
 # This is a clang-only option for improving build times.
 # It forces the instantiation of templates in the PCH itself and
 # not every translation unit it's included in.
@@ -49,11 +40,6 @@ endif
 # instantiations in libutil and libstore.
 if cxx.get_id() == 'clang'
   add_project_arguments('-fpch-instantiate-templates', language : 'cpp')
-  # Catch brace elision bugs: when WorkerProto::Version changed from `unsigned int`
-  # to `struct { unsigned int major; uint8_t minor; }`, `.version = 16` silently
-  # became `.version = {16, 0}` instead of failing, breaking protocol compatibility
-  # in a subtle way
-  add_project_arguments('-Werror=c99-designator', language : 'cpp')
 endif
 
 # Detect if we're using libstdc++ (GCC's standard library)

packaging/binary-tarball.nix

@@ -1,20 +1,16 @@
 {
   runCommand,
-  stdenv,
+  system,
   buildPackages,
   cacert,
   nix,
-  nixComponents2,
 }:
 
 let
 
-  inherit (stdenv.hostPlatform) system;
-
   installerClosureInfo = buildPackages.closureInfo {
     rootPaths = [
       nix
-      nixComponents2.nix-manual.man
       cacert
     ];
   };
@@ -46,7 +42,6 @@ runCommand "nix-binary-tarball-${version}" env ''
     --subst-var-by cacert ${cacert}
   substitute ${../scripts/install-multi-user.sh} $TMPDIR/install-multi-user \
     --subst-var-by nix ${nix} \
-    --subst-var-by nix-manual ${nixComponents2.nix-manual.man} \
     --subst-var-by cacert ${cacert}
 
   if type -p shellcheck; then

packaging/components.nix

@@ -133,7 +133,7 @@ let
       +
         lib.optionalString
           (
-            !(stdenv.hostPlatform.isWindows || stdenv.hostPlatform.isCygwin)
+            !stdenv.hostPlatform.isWindows
             # build failure
             && !stdenv.hostPlatform.isStatic
             # LTO breaks exception handling on x86-64-darwin.
@@ -155,14 +155,12 @@ let
     ];
   };
 
-  mesonBuildLayer = finalAttrs: prevAttrs: rec {
+  mesonBuildLayer = finalAttrs: prevAttrs: {
     nativeBuildInputs = prevAttrs.nativeBuildInputs or [ ] ++ [
       pkg-config
     ];
     separateDebugInfo = !stdenv.hostPlatform.isStatic;
-    # needed by separateDebugInfo
-    # SEE: https://github.com/NixOS/nixpkgs/pull/394674/commits/a4d355342976e9e9823fb94f133bc43ebec9da5b
-    __structuredAttrs = separateDebugInfo;
+    hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
   };
 
   mesonLibraryLayer = finalAttrs: prevAttrs: {
@@ -418,8 +416,6 @@ in
 
   nix-cmd = callPackage ../src/libcmd/package.nix { };
 
-  nix-nswrapper = callPackage ../src/nswrapper/package.nix { };
-
   /**
     The Nix command line interface. Note that this does not include its tests, whereas `nix-everything` does.
   */
@@ -456,6 +452,11 @@ in
   */
   nix-json-schema-checks = callPackage ../src/json-schema-checks/package.nix { };
 
+  /**
+    Kaitai struct schema validation checks
+  */
+  nix-kaitai-struct-checks = callPackage ../src/kaitai-struct-checks/package.nix { };
+
   nix-perl-bindings = callPackage ../src/perl/package.nix { };
 
   /**

packaging/dependencies.nix

@@ -30,23 +30,32 @@ scope: {
         NIX_CFLAGS_COMPILE = "-DINITIAL_MARK_STACK_SIZE=1048576";
       });
 
-  curl =
-    (pkgs.curl.override {
-      http3Support = !pkgs.stdenv.hostPlatform.isWindows;
-      # Make sure we enable all the dependencies for Content-Encoding/Transfer-Encoding decompression.
-      zstdSupport = true;
-      brotliSupport = true;
-      zlibSupport = true;
-    }).overrideAttrs
-      {
-        # TODO: Fix in nixpkgs. Static build with brotli is marked as broken, but it's not the case.
-        # Remove once https://github.com/NixOS/nixpkgs/pull/494111 lands in the 25.11 channel.
-        meta.broken = false;
-      };
+  lowdown = pkgs.lowdown.overrideAttrs (prevAttrs: rec {
+    version = "2.0.2";
+    src = pkgs.fetchurl {
+      url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
+      hash = "sha512-cfzhuF4EnGmLJf5EGSIbWqJItY3npbRSALm+GarZ7SMU7Hr1xw0gtBFMpOdi5PBar4TgtvbnG4oRPh+COINGlA==";
+    };
+    nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ pkgs.buildPackages.bmake ];
+    postInstall =
+      lib.replaceStrings [ "lowdown.so.1" "lowdown.1.dylib" ] [ "lowdown.so.2" "lowdown.2.dylib" ]
+        (prevAttrs.postInstall or "");
+  });
 
-  libblake3 = pkgs.libblake3.override {
-    useTBB = !(stdenv.hostPlatform.isWindows || stdenv.hostPlatform.isStatic);
-  };
+  # TODO: Remove this when https://github.com/NixOS/nixpkgs/pull/442682 is included in a stable release
+  toml11 =
+    if lib.versionAtLeast pkgs.toml11.version "4.4.0" then
+      pkgs.toml11
+    else
+      pkgs.toml11.overrideAttrs rec {
+        version = "4.4.0";
+        src = pkgs.fetchFromGitHub {
+          owner = "ToruNiina";
+          repo = "toml11";
+          tag = "v${version}";
+          hash = "sha256-sgWKYxNT22nw376ttGsTdg0AMzOwp8QH3E8mx0BZJTQ=";
+        };
+      };
 
   # TODO Hack until https://github.com/NixOS/nixpkgs/issues/45462 is fixed.
   boost =

packaging/dev-shell.nix

@@ -131,7 +131,7 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
     ignoreCrossFile = flags: builtins.filter (flag: !(lib.strings.hasInfix "cross-file" flag)) flags;
 
     availableComponents = lib.filterAttrs (
-      k: v: lib.meta.availableOn pkgs.stdenv.hostPlatform v
+      k: v: lib.meta.availableOn pkgs.hostPlatform v
     ) allComponents;
 
     activeComponents = buildInputsClosureCond isInternal (
@@ -142,9 +142,7 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
     internalDrvs = byDrvPath (
       # Drop the attr names (not present in buildInputs anyway)
       lib.attrValues availableComponents
-      ++ lib.concatMap (c: lib.filter (v: !v.meta.broken) (lib.attrValues (c.tests or { }))) (
-        lib.attrValues availableComponents
-      )
+      ++ lib.concatMap (c: lib.attrValues c.tests or { }) (lib.attrValues availableComponents)
     );
 
     isInternal =
@@ -261,13 +259,10 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
 
     # We use this shell with the local checkout, not unpackPhase.
     src = null;
-
     # Workaround https://sourceware.org/pipermail/gdb-patches/2025-October/221398.html
     # Remove when gdb fix is rolled out everywhere.
     separateDebugInfo = false;
 
-    mesonBuildType = "debugoptimized";
-
     env = {
       # For `make format`, to work without installing pre-commit
       _NIX_PRE_COMMIT_HOOKS_CONFIG = "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml"
@@ -282,6 +277,7 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
     dontUseCmakeConfigure = true;
 
     mesonFlags = [
+      (lib.mesonBool "kaitai-struct-checks" (isActiveComponent "nix-kaitai-struct-checks"))
       (lib.mesonBool "json-schema-checks" (isActiveComponent "nix-json-schema-checks"))
     ]
     ++ map (transformFlag "libutil") (ignoreCrossFile pkgs.nixComponents2.nix-util.mesonFlags)
@@ -300,7 +296,7 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
             lib.filter (x: !isInternal x) (
               lib.lists.concatMap (
                 # Nix manual has a build-time dependency on nix, but we
-                # don't want to do a native build just to enter the cross
+                # don't want to do a native build just to enter the ross
                 # dev shell.
                 #
                 # TODO: think of a more principled fix for this.
@@ -323,7 +319,7 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
             pkgs.buildPackages.shellcheck
             pkgs.buildPackages.include-what-you-use
           ]
-          ++ lib.optional stdenv.hostPlatform.isUnix pkgs.buildPackages.gdb
+          ++ lib.optional pkgs.hostPlatform.isUnix pkgs.buildPackages.gdb
           ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) (
             lib.hiPrio pkgs.buildPackages.clang-tools
           )
@@ -341,7 +337,7 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
 
     buildInputs =
       # TODO change Nixpkgs to mark gbenchmark as building on Windows
-      lib.optional stdenv.hostPlatform.isUnix pkgs.gbenchmark
+      lib.optional pkgs.hostPlatform.isUnix pkgs.gbenchmark
       ++ dedupByString (v: "${v}") (
         lib.filter (x: !isInternal x) (lib.lists.concatMap (c: c.buildInputs) activeComponents)
       )

packaging/everything.nix

@@ -31,8 +31,6 @@
 
   nix-cmd,
 
-  nix-nswrapper,
-
   nix-cli,
 
   nix-functional-tests,
@@ -173,9 +171,6 @@ stdenv.mkDerivation (finalAttrs: {
       # Forwarded outputs
       ln -sT ${nix-manual} $doc
       ln -sT ${nix-manual.man} $man
-    ''
-    + lib.optionalString stdenv.isLinux ''
-      lndir ${nix-nswrapper} $out
     '';
 
   passthru = {

packaging/hydra.nix

@@ -57,7 +57,6 @@ let
         "nix-flake"
         "nix-flake-c"
         "nix-flake-tests"
-        "nix-nswrapper"
         "nix-main"
         "nix-main-c"
         "nix-cmd"
@@ -73,6 +72,7 @@ let
         "nix-manual-manpages-only"
         "nix-internal-api-docs"
         "nix-external-api-docs"
+        "nix-kaitai-struct-checks"
       ]
     );
 in
@@ -115,11 +115,7 @@ rec {
 
   # Binary package for various platforms.
   build = forAllPackages (
-    pkgName:
-    lib.filterAttrs (
-      system: _do_not_touch:
-      pkgName == "nix-nswrapper" -> nixpkgsFor.${system}.native.stdenv.hostPlatform.isLinux
-    ) (forAllSystems (system: nixpkgsFor.${system}.native.nixComponents2.${pkgName}))
+    pkgName: forAllSystems (system: nixpkgsFor.${system}.native.nixComponents2.${pkgName})
   );
 
   shellInputs = removeAttrs (forAllSystems (
@@ -139,10 +135,6 @@ rec {
     (
       if pkgName == "nix-functional-tests" then
         lib.flip builtins.removeAttrs [ "x86_64-w64-mingw32" ]
-      else if pkgName == "nix-nswrapper" then
-        lib.filterAttrs (
-          crossSystem: _do_not_touch: nixpkgsFor.x86_64-linux.cross.${crossSystem}.stdenv.hostPlatform.isLinux
-        )
       else
         lib.id
     )
@@ -179,13 +171,7 @@ rec {
         )
       );
     in
-    forAllPackages (
-      pkgName:
-      lib.filterAttrs (
-        system: _do_not_touch:
-        pkgName == "nix-nswrapper" -> nixpkgsFor.${system}.native.stdenv.hostPlatform.isLinux
-      ) (forAllSystems (system: components.${system}.${pkgName}))
-    );
+    forAllPackages (pkgName: forAllSystems (system: components.${system}.${pkgName}));
 
   buildNoTests = forAllSystems (system: nixpkgsFor.${system}.native.nixComponents2.nix-cli);
 
@@ -205,13 +191,7 @@ rec {
         )
       );
     in
-    forAllPackages (
-      pkgName:
-      lib.filterAttrs (
-        system: _do_not_touch:
-        pkgName == "nix-nswrapper" -> nixpkgsFor.${system}.native.stdenv.hostPlatform.isLinux
-      ) (forAllSystems (system: components.${system}.${pkgName}))
-    );
+    forAllPackages (pkgName: forAllSystems (system: components.${system}.${pkgName}));
 
   # Perl bindings for various platforms.
   perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nixComponents2.nix-perl-bindings);

scripts/install-multi-user.sh

@@ -52,10 +52,9 @@ readonly PROFILE_FISH_PREFIXES=(
 readonly PROFILE_NIX_FILE_FISH="$NIX_ROOT/var/nix/profiles/default/etc/profile.d/nix-daemon.fish"
 
 readonly NIX_INSTALLED_NIX="@nix@"
-readonly NIX_INSTALLED_NIX_MAN="@nix-manual@"
 readonly NIX_INSTALLED_CACERT="@cacert@"
-#readonly NIX_INSTALLED_NIX="/nix/store/byi37zv50wnfrpp4d81z3spswd5zva37-nix-2.3.6"
-#readonly NIX_INSTALLED_CACERT="/nix/store/7pi45g541xa8ahwgpbpy7ggsl0xj1jj6-nss-cacert-3.49.2"
+#readonly NIX_INSTALLED_NIX="/nix/store/j8dbv5w6jl34caywh2ygdy88knx1mdf7-nix-2.3.6"
+#readonly NIX_INSTALLED_CACERT="/nix/store/7dxhzymvy330i28ii676fl1pqwcahv2f-nss-cacert-3.49.2"
 EXTRACTED_NIX_PATH="$(dirname "$0")"
 readonly EXTRACTED_NIX_PATH
 
@@ -970,8 +969,6 @@ setup_default_profile() {
     task "Setting up the default profile"
     _sudo "to install a bootstrapping Nix in to the default profile" \
           HOME="$ROOT_HOME" "$NIX_INSTALLED_NIX/bin/nix-env" -i "$NIX_INSTALLED_NIX"
-    _sudo "to install Nix man pages in to the default profile" \
-          HOME="$ROOT_HOME" "$NIX_INSTALLED_NIX/bin/nix-env" -i "$NIX_INSTALLED_NIX_MAN"
 
     if [ -z "${NIX_SSL_CERT_FILE:-}" ] || ! [ -f "${NIX_SSL_CERT_FILE:-}" ] || cert_in_store; then
         _sudo "to install a bootstrapping SSL certificate just for Nix in to the default profile" \

scripts/install-systemd-multi-user.sh

@@ -38,7 +38,6 @@ escape_systemd_env() {
 create_systemd_proxy_env() {
     vars="http_proxy https_proxy ftp_proxy all_proxy no_proxy HTTP_PROXY HTTPS_PROXY FTP_PROXY ALL_PROXY NO_PROXY"
     for v in $vars; do
-        # shellcheck disable=SC2268
         if [ "x${!v:-}" != "x" ]; then
             echo "Environment=${v}=$(escape_systemd_env "${!v}")"
         fi

src/json-schema-checks/build-result

@@ -1 +1 @@
-../libstore-tests/data/build-result
+../../src/libstore-tests/data/build-result

src/json-schema-checks/build-trace-entry

@@ -1 +1 @@
-../libstore-tests/data/realisation
+../../src/libstore-tests/data/realisation

src/json-schema-checks/content-address

@@ -1 +1 @@
-../libstore-tests/data/content-address
+../../src/libstore-tests/data/content-address

src/json-schema-checks/derivation

@@ -1 +1 @@
-../libstore-tests/data/derivation
+../../src/libstore-tests/data/derivation

src/json-schema-checks/deriving-path

@@ -1 +1 @@
-../libstore-tests/data/derived-path
+../../src/libstore-tests/data/derived-path

src/json-schema-checks/file-system-object

@@ -1 +1 @@
-../libutil-tests/data/memory-source-accessor
+../../src/libutil-tests/data/memory-source-accessor

src/json-schema-checks/hash

@@ -1 +1 @@
-../libutil-tests/data/hash
+../../src/libutil-tests/data/hash

src/json-schema-checks/meson.build

@@ -51,13 +51,6 @@ schemas = [
       'simple.json',
     ],
   },
-  {
-    'stem' : 'signature',
-    'schema' : schema_dir / 'signature-v2.yaml',
-    'files' : [
-      'simple.json',
-    ],
-  },
   {
     'stem' : 'deriving-path',
     'schema' : schema_dir / 'deriving-path-v1.yaml',
@@ -69,10 +62,11 @@ schemas = [
   },
   {
     'stem' : 'build-trace-entry',
-    'schema' : schema_dir / 'build-trace-entry-v3.yaml',
+    'schema' : schema_dir / 'build-trace-entry-v1.yaml',
     'files' : [
       'simple.json',
-      'with-structured-signature.json',
+      'with-dependent-realisations.json',
+      'with-signature.json',
     ],
   },
   {
@@ -158,20 +152,20 @@ schemas += [
   # Match overall
   {
     'stem' : 'store-object-info',
-    'schema' : schema_dir / 'store-object-info-v3.yaml',
+    'schema' : schema_dir / 'store-object-info-v2.yaml',
     'files' : [
-      'json-3' / 'pure.json',
-      'json-3' / 'impure.json',
-      'json-3' / 'empty_pure.json',
-      'json-3' / 'empty_impure.json',
+      'json-2' / 'pure.json',
+      'json-2' / 'impure.json',
+      'json-2' / 'empty_pure.json',
+      'json-2' / 'empty_impure.json',
     ],
   },
   {
     'stem' : 'nar-info',
-    'schema' : schema_dir / 'store-object-info-v3.yaml',
+    'schema' : schema_dir / 'store-object-info-v2.yaml',
     'files' : [
-      'json-3' / 'pure.json',
-      'json-3' / 'impure.json',
+      'json-2' / 'pure.json',
+      'json-2' / 'impure.json',
     ],
   },
   {
@@ -186,32 +180,32 @@ schemas += [
   # Match exact variant
   {
     'stem' : 'store-object-info',
-    'schema' : schema_dir / 'store-object-info-v3.yaml#/$defs/base',
+    'schema' : schema_dir / 'store-object-info-v2.yaml#/$defs/base',
     'files' : [
-      'json-3' / 'pure.json',
-      'json-3' / 'empty_pure.json',
+      'json-2' / 'pure.json',
+      'json-2' / 'empty_pure.json',
     ],
   },
   {
     'stem' : 'store-object-info',
-    'schema' : schema_dir / 'store-object-info-v3.yaml#/$defs/impure',
+    'schema' : schema_dir / 'store-object-info-v2.yaml#/$defs/impure',
     'files' : [
-      'json-3' / 'impure.json',
-      'json-3' / 'empty_impure.json',
+      'json-2' / 'impure.json',
+      'json-2' / 'empty_impure.json',
     ],
   },
   {
     'stem' : 'nar-info',
-    'schema' : schema_dir / 'store-object-info-v3.yaml#/$defs/base',
+    'schema' : schema_dir / 'store-object-info-v2.yaml#/$defs/base',
     'files' : [
-      'json-3' / 'pure.json',
+      'json-2' / 'pure.json',
     ],
   },
   {
     'stem' : 'nar-info',
-    'schema' : schema_dir / 'store-object-info-v3.yaml#/$defs/narInfo',
+    'schema' : schema_dir / 'store-object-info-v2.yaml#/$defs/narInfo',
     'files' : [
-      'json-3' / 'impure.json',
+      'json-2' / 'impure.json',
     ],
   },
 ]

src/json-schema-checks/nar-info

@@ -1 +1 @@
-../libstore-tests/data/nar-info
+../../src/libstore-tests/data/nar-info

src/json-schema-checks/signature/simple.json

@@ -1,4 +0,0 @@
-{
-    "keyName": "cache.nixos.org-1",
-    "sig": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-}

src/json-schema-checks/store

@@ -1 +1 @@
-../libstore-tests/data/dummy-store
+../../src/libstore-tests/data/dummy-store

src/json-schema-checks/store-object-info

@@ -1 +1 @@
-../libstore-tests/data/path-info
+../../src/libstore-tests/data/path-info